DMM Cyber Policy

NOTICE TO INSURED – PLEASE READ CAREFULLY

Insuring Agreement A. of this policy provides coverage on a claims made and reported basis and applies only to claims first made against the insured during the policy period or any extended reporting period (if purchased) and first reported to us during the policy period and in accordance with the terms of this Policy.

Claims expenses under this Policy shall reduce and may exhaust the limit of liability of this Policy and are subject to retentions. This Policy is issued by AEGIS London.

Please make sure that you carefully read and understand this Policy, because the Policy's limit of liability, conditions, exclusions and other terms restrict and limit the insurance coverage that is provided. If there is anything that you do not understand or you otherwise have any questions, please ask your broker.

Words and phrases that appear in bold print have special meanings and are defined separately. Whenever a singular form of a word is used, the word shall be interpreted to include the plural form of the word when the plural form of the word is required by the context in which the word is used.

SECTION I - Insuring Agreements

Privacy and Security Breach Liability Coverage

We shall pay on your behalf all damages and claims expenses within the applicable Limit(s) of Liability set forth in the Schedule and in excess of your Retention that you become legally obliged to pay as a result of any claim made against you due to an actual or alleged privacy breach or security breach resulting in a covered incident.

Data Breach Response Services Coverage

In the event of an actual or suspected privacy breach that you and we reasonably agree may trigger a legal obligation for the insured organization to comply with breach notice laws ; you shall be provided with breach notice response services and breach investigation services within the applicable Limit(s) of Liability set forth in the Schedule and in excess of your Retentions.

For clarification, you must use the designated AEGIS Data Breach Panel for all breach notice response services and breach investigation services .

Cyber Extortion Coverage

We shall indemnify the insured organization for cyber extortion expenses it incurs, within the Limit(s) of Liability set forth in the Schedule and in excess of your Retention, as a direct result of a cyber extortion threat .

SECTION II - Defense and Settlement of Claims

It is our right and duty to defend you against a covered claim , subject to the terms and conditions of this Policy, even if the claim is groundless or fraudulent. Our right and duty to defend ends when the Policy’s applicable Limit of Liability has been exhausted by payment of damages or claims expenses .

This Policy does not cover any payment, obligation, or expense that you assume or incur without our prior written consent.

We have the right to select and appoint defense counsel to defend any claim notified under this Policy. You shall cooperate with counsel and any defense counsel that is appointed to defend you .

We have the right to investigate any claim , privacy breach , security breach , or potential claim . We have the right to settle any claim , or potential claim on your behalf.

SECTION III - Definitions

Bodily injury means physical injury, sickness, disease or death of any person, and if arising out of the foregoing, mental anguish or injury, pain and suffering, shock or emotional distress.

Breach investigation services means fees agreed by us and incurred by an outside attorney to identify potential legal violations and defenses arising out of the relevant privacy breach and coordinate the forensic services required to determine the scope and extent of any privacy breach .

Provided that breach investigation services shall not mean, and Insuring Agreement I.B. shall not cover: (i) any expenses incurred for any services after any claim is made against you , and (ii) any salaries, overheads, lost productivity, or other internal costs, expenses or charges you incur.

All breach investigation services shall be provided by the professionals making up the AEGIS Data Breach Panel.

Breach notice law means any governmental statute or regulation that requires an organization to provide notice to an individual whose personally identifiable information was actually, or was reasonably believed to have been, accessed by or disclosed to an unauthorized person.

Breach notice legal and forensic expenses means

fees incurred for the services of a third party computer forensics professional to conduct an investigation to identify whether data containing personally identifiable information was accessed by an unauthorized person as a result of a covered privacy breach ; and

fees for an outside attorney to determine whether any breach notice laws apply and your obligations under such applicable laws, and to assist you to comply with such laws, including but not limited to, drafting notice letters to impacted individuals .

Breach notice response services means any of the following expenses incurred by us or by you with our written consent:

breach notice legal and forensic expenses ;

notice fulfillment services ; and

other costs, subject to our discretion, to mitigate reputational harm to the insured organization .

All breach notice response services shall be provided by the professionals making up the AEGIS Data Breach Panel.

Claim means:

a civil lawsuit for damages or injunctive relief commenced by the filing of a complaint or similar pleading against you , or a demand for arbitration or mediation in which damages are sought from you ;

a written demand for damages .

All claims which have as a common nexus any fact, circumstance, situation, event, transaction, cause or series of related or connected facts, circumstances, situations, events, transactions or causes, shall be considered a single claim regardless of the number of events, allegations, claimants, defendants or causes of action, and shall be deemed to be first made on the date the earliest of such claims is first made, regardless of whether such date is before or during the policy period .

Claims expenses means all necessary and reasonable legal fees, costs or expenses incurred by us , or by you with our prior written consent, for investigation and defense of a covered claim . Claims expenses do not include: any salaries, overhead, lost productivity, or other internal costs, expenses or charges you incur in the investigation, mitigation or defense of any claim or circumstance which might lead to a claim under this Policy; costs or expenses for mitigation of a privacy breach or security breach ; the costs or expenses for or arising out of any implementation, undertaking or maintenance of any security or privacy measures, controls, policies, procedures, assessments or audits; or the investigation of or compliance with any breach notice law , including without limitation any expenses for or arising out of breach notice response services . Claims expenses are part of and not in addition to the Limit of Liability.

Counsel means the attorneys or law firms referenced in the AEGIS Data Breach Panel set forth in Item 11. of the Schedule.

Covered incident means any of the following:

unauthorized access to, or unauthorized use of, your computer system by a person;

physical theft or loss of a data storage device that results in unauthorized access to confidential information provided to the insured organization pursuant to a mutually executed written confidentiality agreement or personally identifiable information ; or

transmission of malicious code from your computer system to a third party’s computer system.

Cyber extortion expenses means money paid by the insured organization , with our prior written consent, to satisfy a demand by an extortionist in conjunction with a cyber extortion threat .

Provided, however, cyber extortion expenses shall not exceed the amount of loss the insured organization would have incurred had the amount described herein not been paid. Cyber extortion expenses shall not be paid or negotiated without our prior consultation and express agreement. The insured organization shall make every reasonable effort to notify the appropriate law enforcement agency or authority before negotiating and surrendering any extortion monies in response to an extortion demand.

Cyber extortion threat means a threat by an extortionist to perpetrate a security breach in order to cause a covered incident or the theft, disclosure, transfer or sale of personally identifiable information , unless a money demand is paid by the insured organization . Any cyber extortion threats that have as a common nexus any fact, circumstance, situation, event, transaction, cause or series of related or connected facts, circumstances, situations, events, transactions or causes, shall be considered a single cyber extortion threat , and shall be deemed to have occurred on the date of the earliest of such cyber extortion threats .

Damages means:

monetary judgment or award you are legally obligated to pay, including punitive or exemplary damages (where insurable by law, and the enforceability of such coverage shall be governed by such applicable law that most favors coverage for punitive or exemplary damages); and

a settlement or consent decree agreed to by you with our prior written consent.

Provided, however, “ damages ” shall not mean or include:

your future royalties or future profits, restitution, disgorgement of profits;

return, collection or offset of fees, royalties, compensation, charges, commissions or other consideration;

amounts awarded pursuant to statutes or regulations other than privacy regulations or intellectual property laws;

the cost to comply with equitable relief, any injunctive or other non-monetary or declaratory relief or any agreement to provide such relief;

the costs or expenses for or arising out of any implementation, undertaking or maintenance of any security or privacy measures, controls, policies, procedures, assessments or audits; or

any amount for which you are not liable, or for which there is no legal recourse against you .

Data storage device means computer hardware (including without limitation, laptops, hard-drives, thumb-drives, PDAs and flash storage devices) that is subject to reasonable encryption processes, do not store personally identifiable information and is protected by reasonable access controls to prevent unauthorized access to such hardware.

Impacted individual means an individual whose personally identifiable information was actually, or was reasonably believed to have been, accessed by an unauthorized person as a result of a covered privacy breach .

Insured organization means:

the legal entity(s) specified in Item 1. of the Schedule acting within the scope of duties in connection with its business; and

any subsidiary of yours , but only with respect to conduct which takes place while it is a subsidiary and otherwise covered by this Policy.

Loss means damages , claims expenses , breach notice response services , breach investigation services , and cyber extortion expenses .

Management control means:

owning interests representing more than fifty percent (50%) of the voting, appointment or designation power for the selection of a majority of: the Board of Directors of a corporation, the management committee members of a joint venture or partnership, or the members of the management board of a limited liability company; or

having the right, pursuant to written contract or the by-laws, charter, operating agreement or similar documents of an entity, to elect, appoint or designate a majority of: the Board of Directors of a corporation, the management committee of a joint venture or partnership or the management board of a limited liability company.

Notice fulfillment services means services to provide notice to impacted individuals under applicable breach notice laws , including printing services, email notice, media notice, mailing services and postage.

Personally identifiable information means any of the following:

any information that relates to a person who can be identified, directly or indirectly, by reference to an identification number or one or more factors specific to their physical, physiological, mental, economic, cultural or social identity;

non-public personal information as defined in any state, federal or foreign law, including without limitation, “protected health information” as defined under the Health Insurance Portability and Accountability Act (HIPAA), “PHR identifiable health information” as defined under the Health Information Technology for Economic and Clinical Health Act (the HITECH Act), and non-public personal information under the Gramm-Leach-Bliley Act; or

an Internet Protocol (IP) address where utilizing reasonable means a third party can identify a specific person with such IP address.

Policy period means the period of insurance stated in Item 2. of the Schedule.

Privacy breach means any of the following:

theft or loss of personally identifiable information , including without limitation, personally identifiable information stored in an electronic medium, or the failure to provide notice of such theft or loss as required under applicable breach notice laws ;

disclosure of personally identifiable information that was not authorized or consented to by the natural person to which such personally identifiable information relates; provided that such disclosure was conducted by your employee without your approval, authorization, participation or acquiescence;

the failure of the wording of your existing privacy policy to comply with a privacy regulation requiring specific wording or notices in privacy policies; provided, however, that at the time of such failure you must have had in force an existing privacy policy .

Any privacy breaches that have as a common nexus any fact, circumstance, situation, event, transaction, cause or series of related or connected facts, circumstances, situations, events, transactions or causes, shall be considered a single privacy breach , and shall be deemed to have occurred on the date of the earliest of such privacy breaches .

Privacy policy means the insured organization’s written and publicly disclosed policies identifying the insured organization’s practices for the collection, use, disclosure, sharing, allowing of access to, and correction of, personally identifiable information .

Privacy regulation means any statute or regulation addressing the control, use or protection of personally identifiable information .

Property damage means injury, impairment, destruction, corruption or distortion of any tangible property, including the loss of use of tangible property even when the tangible property has not itself been physically impaired, injured or destroyed. However, property damage does not mean loss of use of intangible property, including data.

Retroactive date means the date specified in Item 6. of the Schedule.

Security breach means the theft, loss or unauthorized disclosure of confidential information provided to the insured organization pursuant to a mutually executed written confidentiality agreement; provided that such theft, loss or unauthorized disclosure was conducted by your employee without your approval, authorization or acquiescence and “confidential information” shall not include personally identifiable information or components thereof.

Subsidiary shall mean any entity:

the insured organization had management control over on or before the inception date of the policy period ;

the insured organization acquires management control over during the policy period if the total revenue for the entity in the four full quarters prior to acquiring such control does not exceed ten percent (10%) of the Named Insured’s (as specified in Item 1. of the Schedule) total revenue in the four full quarters prior to acquiring such control; and

specifically identified as a “ subsidiary ” by endorsement to this Policy, subject to additional underwriting, terms and premium, and the addition of any such endorsement is at our sole and absolute discretion.

Provided, however, with respect to any subsidiary as defined in III.Q.2., such an entity shall only be considered a “ subsidiary ” for thirty (30) days from the date of such management control . If you would like coverage to be extended to such an entity for more than thirty (30) days from the date of management control , you must provide us with full particulars of such acquired entity and we shall determine, in our sole and absolute discretion whether such entity shall continue to be a subsidiary after such thirty (30) day period. Such continuance is subject to additional underwriting, premium and terms.

Provided further, in the event the insured organization loses or does not maintain management control over an entity referenced in this Definition, that entity ceases to be a subsidiary on the date such control was lost and is no longer an insured under this Policy. In addition, this Policy does not cover any claim or loss alleging or arising out of any error, omission, neglect or breach of duty, privacy breach , security breach , or cyber extortion threat of an entity referenced in this Definition which took place prior to the date the insured organization acquired management control of such entity, or after the date the insured organization| lost management control of such entity. For the purposes of this Definition, for acts or events occurring after the insured organization’s loss of management control , there shall be no relation back of related acts or events.

We , us or our means the insurer/underwriters providing this Policy.

You , your , yours , or insured means:

the legal entity(s) specified in Item 1. of the Schedule acting within the scope of its duties in connection with its business;

any subsidiary of yours , but only with respect to conduct which takes place while it is a subsidiary and otherwise covered by this Policy; and

any employee of the insured organization , but only with respect to acts within the scope of his or her employment by the insured organization .

Your computer system means any computer hardware, software or firmware, and components thereof, and including data stored thereon, that is owned or licensed by the insured organization , and is under the direct operational control of the insured organization or a vendor providing cloud computer services to the insured organization .

SECTION IV - Exclusions

This Policy shall not cover any claim or loss :

with respect to the insured organization , alleging or arising out of any willful, deliberate, malicious, fraudulent, dishonest or criminal act, error or omission by the insured organization , or any intentional or knowing violation of the law, or intentional security breach or privacy breach by the insured organization ;

with respect to a natural person insured , alleging or arising out of any willful, deliberate, malicious, fraudulent, dishonest or criminal act, error or omission by such natural person insured , or any intentional or knowing violation of the law, or intentional security breach or privacy breach by such natural person insured ;

made by one of you against another of you , except a claim brought against you by your employee resulting from a privacy breach that is otherwise covered under Insuring Agreement I.A.;

brought by an entity which:

you own, operate, manage or in which you have an ownership interest in excess of 15%, or in which you are an officer or director, except this provision will not apply to an otherwise covered claim that employee data is the subject of a privacy breach or violation of a privacy regulation ; or

wholly or partly owns, operates, controls or manages you ;

alleging or arising out of any bodily injury or property damage , except this provision will not apply to emotional distress or mental anguish directly arising out of any actual or alleged privacy breach or security breach ;

alleging or arising out of your insolvency, financial impairment or bankruptcy;

alleging or arising out of your activities as a trustee, partner, officer, director or employee of any employee trust, charitable organization, corporation, company or business other than the insured organization ;

alleging or arising out of any act, error, omission, circumstance, privacy breach , security breach , or cyber extortion threat first occurring prior to the retroactive date of this Policy;

alleging or arising out of any act, error, omission, circumstance, privacy breach , security breach , cyber extortion threat , claim or potential claim notified to a prior insurer;

alleging or arising out of any act, error, omission, circumstance, vulnerability, privacy breach , security breach , or cyber extortion threat , if prior to the inception date of this Policy, you knew, or reasonably could have foreseen, that such act, error, omission, circumstance, vulnerability, privacy breach , security breach , or cyber extortion threat formed, or might form, the basis of a claim , potential claim , or any loss covered under this Policy;

alleging or arising out of any contractual liability or obligation or resulting from any breach of contract or agreement, in either oral or written form, including without limitation, any liability assumed under contract or liquidated damages;

alleging or arising out of any alleged or actual electrical or mechanical failures and/or interruption, including an electrical disturbance, surge, spike, brownout or blackout; or outages to gas, water, telephone, cable, satellite, telecommunications or infrastructure comprising or supporting the internet including service provided by the internet service provider that hosts your website;

alleging or arising out of any fire, smoke, explosion, lightning, wind, flood, earthquake, volcanic eruption, tidal wave, landslide, hail, an act of God or any other physical event, however caused;

alleging or arising out of any existence, emission or discharge of any electromagnetic field, electromagnetic radiation or electromagnetism that actually or allegedly affects the health, safety or condition of any person or the environment, or that affects the value, marketability, condition or use of any property;

alleging or arising out of any wrongful employment practice; provided, however, that this exclusion shall not apply to any otherwise covered claim resulting from a privacy breach ;

brought by or on behalf of:

the Federal Trade Commission, the Federal Communications Commission, or any other state, federal, local or foreign governmental entity or regulatory body in such entity’s or body’s regulatory or official capacity;

alleging or arising out of any of the following:

any violation of the Fair Labor Standards Act of 1938, the National Labor Relations Act, the Worker Adjustment and Retraining Act of 1988, the Certified Omnibus Budget Reconciliation Act of 1985, the Occupational Safety and Health Act of 1970, any similar law or legislation of any state, province or other jurisdiction, or any amendment to the above law or legislation, or any violation of any order, ruling or regulation issued pursuant to the above laws or legislation;

any breach of fiduciary duty, responsibility, or obligation in connection with any employee benefit or pension plan, including violation of the responsibilities, obligations or duties imposed upon fiduciaries by the Employee Retirement Income Security Act of 1974 as amended; or

any violation of any local, state or federal laws concerning antitrust or restraint of trade, or any false, deceptive or misleading advertising, or any violation of the Sherman Antitrust Act, the Clayton Act, or the Robinson-Patman Act, as amended;

alleging or arising out of any false, deceptive or unfair trade practice or violation of any consumer protection laws;

alleging or arising out of any infringement, misappropriation or violation of any patent, copyright, trademark, service mark, trade dress or trade name, or any copying, infringement, misappropriation, display, disclosure, publication or misappropriation of any trade secret;

alleging or arising out of ionizing radiations from or contamination by radioactivity from any nuclear fuel or from any nuclear waste or from the combustion of nuclear fuel, the radioactive, toxic, explosive or other hazardous or contaminating properties of any nuclear installation, reactor or other nuclear assembly or nuclear component thereof, or any weapon or device employing atomic or nuclear fission and/or fusion or other like reaction or radioactive force or matter.

SECTION V - General Conditions

Limits of Liability

Our maximum aggregate liability for all damages , claims expenses , breach investigation services , breach notice response services and cyber extortion expenses covered by this Policy, shall be the Limit of Liability set forth in Item 3. of the Schedule. In the event of the exhaustion of such Limit of Liability, we shall have no further liability whatsoever.

If the total amount for breach notice response services or breach investigation services exceeds the applicable limit set forth in Item 3. of the Schedule, we shall have no further obligation to pay for such services. Nonetheless, you may continue to utilize the members of the AEGIS Data Breach Panel to provide such services (often at discounted rates) at your own expense.

We shall not be obligated to pay any damages , claims expenses , breach notice response services , breach investigation services , or cyber extortion expenses , or to undertake or continue defense of any suit or proceeding, after our Limit of Liability set forth in Item 3. of the Schedule (or any applicable sublimit) has been exhausted by payment of damages , claims expenses , breach notice response services , breach investigation services , or cyber extortion expenses , or after our deposit of the Limit of Liability set forth in Item 3. of the Schedule (or any applicable sublimit) in a court of competent jurisdiction. Upon such payment, we shall have the right to withdraw from the further defense of any claim under this Policy by tendering control of said defense to the insured organization .

Retention

We will only be liable for covered amounts and services in excess of any applicable Retention(s).

As a condition precedent to our liability under this Policy, the Retention stated in Item 4. of the Schedule shall be applicable to each covered claim , shall apply to both covered damages and claims expenses , or any combination thereof, resulting from each such claim , and shall be satisfied by proof of payments by you .

Conditions Precedent

It is a condition precedent to coverage and our liability under this Policy, that at all times during the policy period you shall:

maintain anti-virus and malware prevention solutions on your computer system and update the protection at regular intervals;

maintain firewalls on your computer system;

maintain and implement ongoing patch management process to ensure timely patching of your computer system ; and

store all data on mobile data storage devices or media in an encrypted format, including but not limited to back up tapes and discs, laptops, USB devices, smart phones and tablets.

Notice/Claims Reporting Provisions

If any claim is made against you , you shall as soon as practicable during the policy period , forward to us through counsel , the claim and every letter or other communication concerning the claim , demand, notice, summons or other process received by you or your representative.

For purposes of Insuring Agreement I.B., in the event of an actual or suspected privacy breach , you shall immediately provide to us during the policy period through counsel , written notice of such privacy breach . In addition, you shall as soon as practicable, provide to us through counsel , the following information: a description of the privacy breach (including when it occurred and when it was discovered), an indication of the number of individuals that reasonably may have been impacted, the type of information that may have been impacted, the actions taken to mitigate, contain and prevent the privacy breach and other information and particulars relevant to the cause of, and harm caused by, the privacy breach and a copy of (or link to) your relevant privacy policy and information security policy.

When notice of a claim , privacy breach or potential claim is provided by you to counsel , our efforts to work with you on the potential loss commence. Counsel will contact you to gain an understanding of the situation that is generating the claim , privacy breach or potential claim , and to work along with us and you .

If during the policy period , you become aware of any potential claim or circumstance that might generate a claim , we encourage you to provide notice to us through counsel during the policy period so that we may commence our work with you to contain the loss . Notice of a potential claim or circumstance that has yet to develop into a claim is not required, but is encouraged.

When notice of a potential claim is provided, and the situation develops such that a claim is, or multiple claims are, made against you arising out of such potential claim , then all such claims shall be considered a single claim and written notice of the claim will be deemed to have been made at the time when the first written notice of the potential claim was provided to counsel pursuant to paragraph 4. above.

A claim , privacy breach , or cyber extortion threat shall be considered to be notified to us when written notice is first given to counsel (who will inform us ) of the claim , privacy breach , or cyber extortion threat .

If you make any claim for coverage knowing the same to be false or fraudulent, as regards amount or otherwise, this Policy shall become void and all claims for coverage hereunder shall be forfeited.

Other Insurance

The coverage provided by this Policy is excess over and above any other valid insurance, (including any retention or deductible portion) or agreement of indemnity available to you.

Legal Action Against Us

No person or organization has a right to:

join us as a party or otherwise bring us into an action or suit; or

sue us or bring any other action against us ;

unless and until, as a condition precedent thereto, you have fully complied with all the terms and conditions of this Policy. In no event shall we be liable for any amounts that are not covered and payable under the terms of this Policy or that are in excess of any applicable Limit of Liability.

You acknowledge and agree that all entities and persons that make up the AEGIS Data Breach Panel are not our agents or employees. In the event breach notice response services or breach investigation services is not covered and you wish to utilize an entity or person from the AEGIS Data Breach Panel, you shall independently retain the entities or persons providing such services. In no event shall we be liable for any claims , loss , harm, suits or otherwise arising out of any act, error or omission of any entity or person from the AEGIS Data Breach Panel. You may not bring, and hereby waive, any actions against us arising out of the goods or services provided by any entity or person from the AEGIS Data Breach Panel.

Choice of Law Provision

For all purposes, any dispute concerning this Policy shall be interpreted according to the law of country and state referenced in Item 10. of the Schedule, which conflict of law principles shall not be used to adopt the law of any other jurisdiction.

Subrogation

In the event we are required to make any form of payment under this Policy, we shall be subrogated to all your rights of recovery against any person or organization and you must execute and deliver instruments and papers and do whatever else is necessary to secure such rights. You must not do anything to prejudice such rights. Any recoveries shall be applied first to subrogation expenses, second to any amounts paid by us , and lastly to the retention. Any additional amounts recovered shall be paid to the Named Insured.

Changes

Notice to any agent or knowledge possessed by any agent or by any other person shall not effect a waiver or a change in any part of this Policy or stop us from asserting any right under the terms of this Policy; nor shall the terms of this Policy be waived or changed, except by endorsement executed by us and issued to form a part of this Policy.

Mergers and Acquisitions

If you consolidate into, merge into or are acquired by another entity, then all coverage under this Policy shall terminate at the date of the consolidation, merger or acquisition unless we have issued an endorsement extending coverage under this Policy, and you have agreed to any additional terms of coverage required by us , and agreed to and paid any additional premiums required by us .

Assignment

This Policy may not be assigned to any party unless we consent in writing to the assignment.

Headings

The titles of paragraphs, section, provisions, or endorsements of or to this Policy are intended solely for convenience and reference, and are not deemed in any way to limit or expand the provisions to which they relate and are not part of this Policy.