What is the Christian Brothers Automotive franchisee's obligation regarding the confidentiality of Customer Information?

imately purchases any goods or Services from Franchisee. "Customer Information"

Franchise Agreement (Ver 04-14-2025)

Franchisee: ___________

Franchisor: Christian Brothers Automotive Corporation

means any information that Franchisee collects or is required by the Franchisor to collect from and/or maintain about a Customer in connection with the operation of the Franchised Business, including, without limitation, information collected from the point-of-sale systems installed at the Franchised Business. With respect to the privacy of Customer Information, Franchisee will: (i) comply with all applicable privacy laws ("Privacy Laws"); (ii) comply with all mandatory policies in the Confidential Operations Manual that relate to Privacy Laws and the privacy and security of Customer Information; (iii) comply with any posted privacy policy and/or other representations made to Customers, and communicate any limitations required thereby to any authorized receiving party in compliance with all Privacy Laws; (iv) refrain from any action or inaction that could cause Franchisor to breach any Privacy Laws; (v) maintain reasonable physical, technical and administrative safeguards for Customer Information that is in Franchisee's possession or control in order to protect the same from unauthorized processing, destruction, modification, or use that would violate this Agreement or any Privacy Laws; and (vi) undertake any action(s) Franchisor deems necessary to keep Franchisor in compliance with the Privacy Laws. Franchisee will, upon Franchisor's request, provide Franchisor or Franchisor's representatives with access to Franchisee's systems, records, processes and practices that involve processing of Customer Information in order to mitigate a security incident or so that an audit may be conducted. Without limitation to any of the other indemnity obligations in this Agreement, Franchisee will indemnify, defend and hold Franchisor harmless from losses arising out of or relating to: (a) any theft, loss or misuse of Customer Information; and (b) Franchisee's breach of any of the terms, conditions or

Franchise Agreement (Ver 04-14-2025)

Franchisee: ___________

Franchisor: Christian Brothers Automotive Corporation

Property: ____________ 50

obligations relating to data security, privacy, or Customer Information set forth in this

Agreement. Franchisee will immediately notify Franchisor upon discovering or otherwise

learning of any theft, loss or misuse of Customer Information. Franchisee will, at

Franchisor's direction, (x) undertake remediation efforts at Franchisee's sole expense, (y)

undertake efforts to prevent the recurrence of the same type of incident, and (z) reasonably

cooperate with any remediation efforts undertaken by Franchisor. Franchisee will not make

any public comment regarding any data security incident without Franchisor's approval.

Any notifications to the media or to Customers regarding theft or loss of Customer

Information will be handled exclusively by Franchisor at Franchisor's discretion, and

Franchisee may not contact Customers relating to such theft or loss unless Franchisee is

under a legal obligation to notify Customers, in which event (1) Franchisee must notify

Franchisor in writing promptly after concluding that Franchisee has the legal obligation to

notify Customers and (2) Franchisee will limit the notices to Customers to those required

by law or as pre-approved by Franchisor.

Source: Item 23 — RECEIPTS (FDD pages 76–372)