Privacy: Describe [[Organization A:Organization]]’s privacy and security policies; indicate if they are in writing; and whether they are compatible with [[Bank of America:Organization]]’s policies.

If you have any questions about this Privacy Notice, including any requests to exercise your legal rights, please contact a member of our Privacy Team at ​.

transfer, disposal, or any other processing (collectively “Process” or “Processing”) of Personal Data, including without limitation HIPAA, the California Consumer Privacy Act, and the European Union General Data Protection Regulation (EU 2016/679) (collectively, the “Privacy Laws”). To ensure compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply with, and take all appropriate steps necessary to ensure compliance in all material respects with their policies and procedures relating to data privacy and security, and the Processing of Personal Data and Confidential Data (the “Privacy Statements”). The Company and its subsidiaries have, except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, at all times since inception provided accurate notice of its Privacy Statements then in effect to its customers, employees, third party vendors and representatives. None of such disclosures made or contained in any Privacy Statements have been materially inaccurate, misleading, incomplete, or in material violation of any Privacy Laws. The Company further certifies that neither it nor any of its subsidiaries # has received notice of any actual or potential claim, complaint, proceeding, regulatory proceeding or liability under or relating to, or actual or potential violation of, any of the Privacy Laws, contracts related to the Processing of Personal Data or Confidential Data, or Privacy Statements, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice, # is currently conducting or paying for, in whole or in part, any investigation, remediation, or other corrective action pursuant to any Privacy Law or contract, or # is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy Notice

Data Privacy. This section replaces [Section 16] of the Agreement:

Data Privacy. The following provision supplements Section 16 of the Award:

waives any data privacy rights Recipient may have with respect to such data; and

“Information Privacy and Security Laws” means all applicable laws concerning the privacy, data protection, transfer, or security of Personal Confidential Information, including, to the extent applicable, the Fair Credit Reporting Act, Federal Trade Commission Act, CAN SPAM Act, Telephone Consumer Protection Act, Telemarketing and Consumer Fraud and Abuse Prevention Act, Children’s Online Privacy Protection Act, the Payment Card Industry Data Security Standards, the guidance of each Governmental Entity that pertains to such laws, the General Data Protection Regulation (EU), other state, and federal, data security laws, data breach notification laws, and consumer protection laws.

Data Privacy Notice. You hereby acknowledge that you have read and understood the terms regarding collection, processing and transfer of Data contained in Section 9(f) (Data Privacy Consent) of the Agreement and by participating in the Plan, you agree to such terms. In this regard, upon request of the Corporation or your Employer, you agree to provide an executed data privacy consent form to your Employer or the Corporation (or any other agreements or consents that may be required by your Employer or the Corporation) that the Corporation and/or your Employer may deem necessary to obtain under the data privacy laws in your country, either now or in the future. You understand you will not be able to participate in the Plan if you fail to execute any such consent or agreement.

Data Privacy. This provision supplements [Section 9] of the Global Restricted Stock Unit Award Agreement: