What assurances has the CRS Supplier given Camp Margaritaville regarding Supplier Aggregate Data?

• A. Nothing in these CRS Terms of Use is intended to prevent the CRS Supplier from disclosing, marketing, publishing, or otherwise using Customer's and Properties' aggregate reservations data, as long as the CRS Supplier ensures that such marketing, use and disclosure is solely in anonymized and aggregate form and that such aggregate data are blended with substantial other aggregated data, collected from other Margaritaville and CRS Supplier customers and maintained by the CRS Supplier in an anonymized format ("Supplier Aggregate Data"). CRS Supplier has assured Margaritaville that: (i) such Supplier Aggregate Data does not include any Guest Information or other personal data, (ii) such Supplier Aggregate Data does not include any information from which one could identify Customer or any of its Properties or guests, and (iii) CRS Supplier's use or disclosure of such Supplier Aggregate Data is in compliance with all applicable laws and regulations, as applied to either Customer, Customer's Properties, Margaritaville or CRS Supplier.
• B. CRS Supplier has assured Margaritaville that it will implement and maintain appropriate administrative, technical and physical safeguards designed to ensure the security or integrity of Customer Confidential Information including any Guest Information and Reservation Data and shall protect against unauthorized access to or use of such Customer Confidential Information including Guest Information and Reservation Data.
• C. In the event of a data security incident involving Guest Information and Reservation Data, the CRS Supplier has assured Margaritaville that it shall be responsible for the reasonable and documented costs incurred by Customer in connection with such incident, including,

but not limited to, the following items: (a) costs of any required forensic investigation to determine the cause of the data security breach, (b) providing notification of the security breach to applicable government and relevant industry self-regulatory agencies, to the media (if required by applicable Law) and to individuals whose personal information may have been accessed or acquired, (c) providing credit monitoring service (if required by applicable law or any enforcement order, decree or consent) to individuals whose personal information may have been accessed or acquired for a period of one year, and (d) operating a call center to respond to questions from individuals whose personal information may have been accessed or acquired for a period not to exceed one year.

Source: Item 23 — RECEIPTS (FDD pages 72–406)