What is Carls Jr.'s obligation regarding the misuse of Customer Data by a Third Party Provider?

• 7.1. Each of Olo and Customer (in such capacity, the "Indemnifying Party") shall defend, indemnify and hold harmless the other Party and its officers, directors and employees (each an "Indemnified Party") from all third-party claims and liabilities (including reasonable outside attorney's fees) arising out of or relating to the Indemnifying Party's (i) negligent acts or omissions including the negligent acts or omissions of its employees, subcontractors or representatives and with respect to Customer, its Third Party Providers or Authorized Operators; (ii) breach of Section 5 or 6; or (iii) infringement or misappropriation of a third party's trade secret, or United States patent, trademark or copyright, or other intellectual property right in connection with (a) with respect to Olo, the Licensed Applications, software or other technology Olo uses to provide the Services to Customer hereunder and (b) with respect to Customer, the technology, data, or other materials Customer provides or uses with the Services ("Customer Materials") (the indemnification obligation of each Party described in this clause (iii), the "IP Infringement Obligation"). The previous sentence states the sole liability of the Indemnifying Party, and the sole remedy of the Indemnified Party, with respect to any third-party claim arising out of the Indemnifying Party's negligent acts or omissions (other than claims arising from fraud, criminal activity or willful misconduct).

• 7.2. Additionally, Customer shall defend, indemnify and hold harmless Olo and and its officers, directors and employees (each, an

• "Indemnified Party") from all third-party claims and liabilities (including reasonable outside attorney'sfees) arising out of or relating to (i) any action against Olo arising out of any Customer Third Party Provider's disclosure or misuse of Customer Data or related to Olo's release of such Customer Data, including PII, if the release of such information was requested in writing by Customer; (ii) Customer's failure to properly collect and remit taxes or other government payments or fees associated with its usage of the Services, which shall be the sole responsibility of the Customer and, if applicable, the Authorized Operators; and (iii) the transfer of Customer Data by any means not recommended or deemed reasonably secure by Olo.

• 7.3.

The Indemnified Party must (a) promptly notify the Indemnifying Party in writing of any third-party claim (provided that a failure to promptly notify will not relieve the Indemnifying Party of its indemnification obligations, except to the extent it has been prejudiced by such failure); (b) reasonably cooperate with the Indemnifying Party in the defense of the matter; and (c) give the Indemnifying Party primary control of the defense of the matter and negotiations for its settlement.

The Indemnified Party may, at its own expense, join in the defense with counsel of its choice.

The Indemnifying Party may not enter into a settlement unless it (i) involves only the payment of monetary damages by the Indemnifying Party, and (ii) includes a complete release of liability in favor of the Indemnified Party; any other settlement will be subject to the written consent of the Indemnified Party (not to be unreasonably withheld).

Source: Item 23 — RECEIPTS (FDD pages 76–364)