“Privacy Contract” means any contract entered into in connection with applicable privacy protection laws or regulations.

Data Privacy Notice and Consent. This provision supplements Section 9(f) (Data Privacy Consent) of the Agreement:

Data Privacy. The following provision replaces Section 9(f) (Data Privacy Consent) of the Agreement in its entirety:

Each Target Company is, and since January 1, 2016, has been, in compliance in all material respects with all applicable Privacy and Security Requirements. The Target Companies have delivered to Buyer true, correct and complete copies of all Privacy Policies and Privacy Contracts. The Target Companies have implemented Privacy Policies as required by applicable Privacy and Security Requirements, and the Target Companies are in compliance in all material respects with all such Privacy Policies. The Target Companies have a valid and legal right (whether contractually, by law or otherwise) to Process all Personal Information in connection with the use and/or operation of its products, services and business.

Ceridian employs a Privacy Officer who is charged with ensuring that Ceridian complies with all privacy-related obligations imposed by statute or contract. Any questions regarding the collection, use, access, disclosure, retention or destruction of Confidential Information should be directed to the Privacy Officer.

Compliance with Data Privacy Laws. The Company and its subsidiaries are in material compliance with all applicable state and federal data privacy and security laws and regulations, including without limitation HIPAA, and, to the extent applicable to the Company and its subsidiaries, the Company and its subsidiaries are in material compliance with the GDPR (EU 2016/679) (collectively, the “Privacy Laws”). To ensure compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply with, and take steps designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). The Company represents that neither it nor any subsidiary: # has received written notice of any actual or potential liability under or relating to, or actual or potential violation of, any of the Privacy Laws; # is currently conducting or paying for, in whole or in part, any investigation, remediation, or other corrective action pursuant to any Privacy Law; or # is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

The Company headquarters is located at 103 JFK Parkway, Short Hills, New Jersey 07078, USA and grants Performance RSUs to employees of the Company and its subsidiaries and affiliates, at its sole discretion. If the Participant would like to participate in the Plan, please review the following information about the Company’s data processing practices and declare the Participant’s consent.

Privacy: Describe [[Organization A:Organization]]’s privacy and security policies; indicate if they are in writing; and whether they are compatible with [[Bank of America:Organization]]’s policies.

If you have any questions about this Privacy Notice, including any requests to exercise your legal rights, please contact a member of our Privacy Team at ​.

Data Privacy Notice