> _Markdown transcription of AIG New Zealand AIG CyberEdge policy wording, effective 2024-05-01. Source: https://www.aig.co.nz/content/dam/aig/apac/new-zealand/new-documents/aig-nz-cyberedge-policy-wording.pdf_ --- Financial Lines Policy Wording CyberEdge® Table of Contents Policy Introduction 3 About the Policy 3 Copyright 3 Important Notice 3 Privacy 4 Dispute Resolution Process 5 Section A: CyberEdge Coverage 6 Event Management Coverage 6 Network Interruption Coverage 12 Security and Privacy Liability Coverage 17 Digital Media Content Liability Coverage 22 Cyber Extortion Coverage 27 Cyber Crime Coverage 30 Criminal Reward Fund Coverage 37 Loss Prevention Services 38 Section B: Costs and Expenses 39 Section C: General Terms and Conditions 40 1. Application of General Terms and Conditions 40 2. Cover 40 3. Limits of Liability 40 4. Retentions 40 5. Subrogation 40 6. Recoveries 41 7. Claims 41 8. General Provisions 43 9. Definitions 44 10. Exclusions 46 AIG I CyberEdge® Policy Wording 05-24 | Page 2 of 47 Policy Introduction About the Policy Your policy is made up of this document, the Schedule and any Endorsements and they should all be read as one document. Your policy is a legal contract between You and the Insurer. If You think that any details contained in these documents are not correct or if You need to change anything, You should ask Your insurance intermediary to tell the Insurer. There are specific conditions, specific exclusions and specific definitions that only apply to a specific policy Section. In addition, there are general conditions, general exclusions, general Claims conditions and general definitions that are part of this policy and apply to each policy Section. You only have cover under those Sections of the policy for which the details for that Section are completed in the Schedule. Copyright The content of this policy, including but not limited to the text and images herein, and their arrangement, is the copyright property of the Insurer. All rights reserved. The Insurer hereby authorises you to copy and display the content herein, but only in connection with the Insurer’s business. Any copy You make must include this copyright notice. Limited quotations from the content are permitted if properly attributed to the Insurer; however, except as set forth above, You may not copy or display for redistribution to Third Parties any portion of the content of this policy without the prior written permission of the Insurer. No modifications of the content may be made. Nothing contained herein shall be construed as conferring by implication or otherwise any license or right under any patent, trademark, copyright (except as expressly provided above), or other proprietary rights of the Insurer or of any Third Party. Important Notice CLAIMS-MADE AND NOTIFIED INSURANCE Section A Directors and Officers’ Liability, Corporate Liability, Employment Practices Liability, Statutory Liability, Employers’ Liability, Crime Protection, Tax Audit and Review, and Section B of this policy contains coverage on a Claims-made and notified basis. This means that this policy only covers Claims first made against You during the Policy Period and first notified to the Insurer in writing during the Policy Period. This policy does not provide cover for any Claims made against You during the Policy Period if at any time prior to the commencement of the Policy Period You became aware of facts which might give rise to those Claims being made against You. Section A Directors and Officers’ Liability, Corporate Liability, Employment Practices Liability, Statutory Liability, Employers’ Liability, Crime Protection, Tax Audit and Review and Section B of this policy do not cover Claims arising out of, based upon or attributable to any: a) facts alleged or the same or related acts, errors or omissions alleged or contained in any Claim which has or should have been notified or in any circumstances of which notice has or should have been given under any policy of which this policy is a renewal or replacement or which it may succeed in time; or b) any pending or prior or civil, criminal, administrative or regulatory proceeding, investigation, arbitration or adjudication as of the Continuity Date, or alleging or deriving from the same or essentially the same facts as alleged in such actions. YOUR DUTY OF DISCLOSURE Before you enter into a contract of insurance with the Insurer, You have a duty to disclose to the Insurer every matter that You know, or could reasonably be expected to know, is relevant to the Insurer’s decision whether to accept the risk of the insurance and, if so, on what terms. You have the same duty to disclose those matters to the Insurer before You renew, extend, vary or reinstate a contract of general insurance. Your duty however does not require You to disclose a matter: • that diminishes the risk to be undertaken by the Insurer; • that is of common knowledge; • that the Insurer knows or, in the ordinary course of business, ought to know; or • as to which compliance with Your duty is waived by the Insurer. AIG I CyberEdge® Policy Wording 05-24 | Page 3 of 47 NON-DISCLOSURE If You fail to comply with Your duty of disclosure the Insurer may avoid the contract from its beginning. For further details of the circumstances in which the Insurer has the ability to avoid cover, please see clause 2 of the General Provisions. Privacy The Insurer complies with the Information Privacy Principles. The Information Privacy Principles apply to any Personal Information collected by the Insurer. PURPOSE OF COLLECTION The Insurer collects Personal Information about You for the purposes of assessing Your application for insurance and administering Your policy. Failure to provide relevant Personal Information may result in the Insurer not being able to administer Your policy, process any Claim under Your policy or You may breach Your duty of disclosure. DISCLOSURE In the course of administering your policy the Insurer may disclose Your information to: • an entity to which the Insurer is related either in New Zealand or overseas; • contractors or Third Party providers providing services related to the administration of Your policy; • banks and Financial Institutions for the purpose of processing Your application for insurance and obtaining policy payments; • in the event of a Claim, assessors, lawyers, Third Party administrators, emergency providers and medical providers; • Third Party service providers to enable the Insurer to advise You of their insurance products or services; and • reinsurers for the purpose of obtaining reinsurance, if required. The Insurer will only disclose Your Personal Information to these parties for the primary purpose for which it was collected or to enable the Insurer to advise You of its insurance products or services. In some circumstances the Insurer is entitled to disclose Your Personal Information to Third Parties without Your authorisation such as law enforcement agencies or government authorities. ACCESS TO YOUR INFORMATION You may gain access to Your information by submitting a written request to the Insurer. In some circumstances the Insurer may not permit access to Your Personal Information. Circumstances where access may be denied include where it would compromise the privacy of other individuals or where it would be unlawful. The Insurer has also established an internal dispute resolution process for handling customer complaints and an access and correction procedure. Both procedures are generally free of charge however the Insurer reserves the right to charge for access requests in limited circumstances. If You feel You have a complaint about the Insurer’s information privacy principles, require assistance in lodging a privacy complaint or You wish to gain access to Your information, You may write to: The Privacy Manager AIG Insurance New Zealand Limited PO Box 1745 Shortland Street Auckland 1140 (64) 9 355 3100 privacy.officerNZ@aig.com Your complaint will be reviewed and You will be provided with a written response. If it cannot be resolved, Your complaint will be referred to the Internal Disputes Resolution Committee who will respond within 15 business days. In either case the matter will be reviewed by a person or persons with appropriate authority to deal with the complaint. Should Your complaint not be resolved by the Insurer’s internal dispute resolution process, You may take Your complaint to the Privacy Commissioner for review of the determination. AIG I CyberEdge® Policy Wording 05-24 | Page 4 of 47 Dispute Resolution Process The Insurer is committed to handling any complaints about its products or services efficiently and fairly. If You have a complaint about the Insurer’s products or services, contact Your insurance intermediary and they may raise it with the Insurer. If Your complaint is not satisfactorily resolved You may request that Your matter be reviewed by management by writing to: The Complaints Manager AIG Insurance New Zealand Limited PO Box 1745 Shortland Street Auckland 1140 customerfeedbacknz@aig.com If You are still unhappy, You may request that the matter be reviewed by the Insurer’s Internal Dispute Resolution Committee. The Insurer will respond to You with the Committee’s findings within 15 business days. If You are not satisfied with the finding of the Committee, You may be able to take Your matter to the insurance industry’s independent dispute resolution body. This external dispute resolution body can make decisions with which the Insurer is obliged to comply. AIG I CyberEdge® Policy Wording 05-24 | Page 5 of 47 Section A: CyberEdge Coverage Event Management Coverage 1. Insurance Covers 1.1 EVENT MANAGEMENT The Insurer will pay to or on behalf of each Company: (i) Legal Expenses; (ii) IT Expenses; (iii) Data Recovery Expenses; (iv) Reputation Protection Expenses; (v) Notification Expenses; (vi) Credit Monitoring and ID Monitoring Expenses; (if Bricking Recovery Expenses Cover is Included) Bricking Recovery Expenses; and (vii)  (viii) (if First Response Cover is Included) First Response Expenses, incurred solely as a result of an Insured Event which has occurred, or the Company’s Responsible Officer reasonably believes has occurred, before or during the Policy Period, and of which the Company’s Responsible Officer first becomes aware during the Policy Period. First Response Expenses will only be paid by the Insurer to the extent that they are incurred during the period commencing when the Company’s Responsible Officer first notifies the First Response Advisor of the Insured Event by contacting the Emergency Number specified in the schedule and continuing for the number of hours stated for the First Response Cover in the schedule. No Retention shall apply to First Response Expenses. 2. Definitions The following definitions are specific to this Event Management Coverage Section. All other definitions set out within Section 9 (Definitions) of the General Terms and Conditions shall apply as stated. BREACH OF CONFIDENTIAL INFORMATION Unauthorised access to or unauthorised disclosure of Confidential Information. BRICKING RECOVERY EXPENSES The reasonable and necessary fees, costs and expenses incurred by a Company, with the Insurer’s prior written consent, on actions taken to replace any part of a Company Computer System on which lost, damaged, destroyed, encrypted or corrupted Data was stored that is no longer functional, but only: (i) where such actions are reasonable and are necessary to restore, recreate, repair or recollect such Data in accordance with subparagraph (iii) of the “Data Recovery Expenses” Definition; and (ii) to the extent that cover for such fees, costs and expenses are not available under the Network Interruption Coverage Section. COMPANY COMPUTER SYSTEM (i) Any computer hardware, software or any components thereof that are linked together through a network of two or more devices accessible through the internet or an intranet or that are connected through Data storage or other peripheral devices which are owned, operated, controlled or leased by a Company; (ii) any of the foregoing computer hardware, software or components thereof which is part of an industrial control system, including a supervisory control and Data acquisition (SCADA) system; or (iii) any Employee “Bring Your Own Device” but only to the extent such device is used to access any of the foregoing computer hardware, software or components thereof or Data contained therein. For the purposes of Bricking Recovery Expenses only, Company Computer System shall not include subparagraph (iii) above. AIG I CyberEdge® Policy Wording 05-24 | Page 6 of 47 CONFIDENTIAL INFORMATION Corporate Information and Personal Information in a Company’s or Information Holder’s care, custody or control or for which a Company is legally responsible. CORPORATE INFORMATION A Third Party’s items of information that are not available to the public (including trade secrets, Data, designs, forecasts, formulas, practices, processes, records, reports and documents) which are subject to contractual or legal protection. CREDIT MONITORING AND ID MONITORING EXPENSES The reasonable and necessary fees, costs and expenses incurred by a Company, with the Insurer’s prior written consent, for Credit Monitoring and ID Monitoring Services provided to those Data Subjects whose Personal Information is reasonably believed to have been disclosed or transmitted. Such fees, costs and expenses will only be paid by the Insurer for Data Subjects that request and/or activate the Credit Monitoring and ID Monitoring Services within ninety (90) days after receiving notification from the Company that their Personal Information is reasonably believed to have been disclosed or transmitted. In such a case, Credit Monitoring and ID Monitoring Services will only be provided to each such Data Subject for a period of two (2) years from the date of activation. CREDIT MONITORING AND ID MONITORING SERVICES Credit or identity theft monitoring services to identify possible misuse of any Personal Information as a result of an actual or suspected Breach of Confidential Information. CYBER TERRORISM The premeditated use of disruptive activities against a Company Computer System or network, or the explicit threat to use such activities, by an individual or group of individuals, whether acting alone or on behalf of or in connection with any entity or government, in each case with the intention to cause harm, further social, ideological, religious, political or similar objectives, or to intimidate any person(s) in furtherance of such objectives. Cyber Terrorism does not include any such activities which are part of or in support of any use of military force or war. DATA PROTECTION LEGISLATION The Privacy Act 2020, and any subsequent legislation that alters, repeals or replaces such legislation and all other equivalent laws and regulations relating to the regulation and enforcement of Data protection or Data privacy in any country. DATA RECOVERY EXPENSES The reasonable and necessary fees, costs and expenses incurred by a Company, with the Insurer’s prior written consent, on actions taken to: (i) identify lost, damaged, destroyed, encrypted or corrupted Data; (ii) determine whether any lost, damaged, destroyed, encrypted or corrupted Data can be restored, repaired, recollected or recreated; and (iii) restore, recreate, repair or recollect lost, damaged, destroyed, encrypted or corrupted Data to substantially the form in which it existed immediately prior to the Insured Event, including where necessary the cost to restore Data from backups or recreate Data from physical records. DATA SUBJECT Any natural person whose Personal Information has been either collected, stored or processed by or on behalf of a Company. FIRST RESPONSE ADVISOR The law firm specified in the schedule, or other law firms instructed by such specified law firm, or any replacement firm nominated by the Insurer in the event of a conflict of interest, with respect to whom a Company shall enter into a Relevant Engagement. FIRST RESPONSE EXPENSES The reasonable and necessary fees, costs and expenses (as determined by the Insurer at its sole discretion) of: (i) the First Response Advisor providing First Response Legal Services; (ii) the First Response IT Specialist providing IT Services; and (iii) the Public Relations Advisor, if its appointment is considered necessary by the First Response Advisor or the Insurer, providing Reputation Protection Services. AIG I CyberEdge® Policy Wording 05-24 | Page 7 of 47 FIRST RESPONSE IT SPECIALIST The information technology services firm appointed by the Insurer or First Response Advisor. FIRST RESPONSE LEGAL SERVICES (i) legal advice and support provided pursuant to a Relevant Engagement; (ii) coordinating the First Response IT Specialist, and, if considered necessary by the First Response Advisor or Insurer, the Public Relations Advisor; and (iii) preparation of notices and notification to any relevant Regulator. INFORMATION HOLDER A Third Party that holds Personal Information or Corporate Information on behalf of a Company. INSURED A Company. INSURED EVENT (i) A Breach of Confidential Information; (ii) a Security Failure; or (iii) in respect of Data Recovery Expenses only, an Operational Failure. IT EXPENSES The reasonable and necessary fees, costs and expenses (as determined by the Insurer at its sole discretion) of an IT Specialist providing IT Services. IT SERVICES The services of: (i) substantiating whether an Insured Event has occurred, how it occurred and whether it is still occurring; (ii) identifying any compromised Data resulting from an Insured Event; (iii) establishing the extent to which Confidential Information may have been compromised resulting from an Insured Event; or (iv) containing and resolving an Insured Event and making recommendations to prevent or mitigate a future occurrence of the same or similar event. IT SPECIALIST An information technology services firm appointed by the Insurer, the Response Advisor, or a Company where that firm has been approved by the Insurer in advance of such appointment. LEGAL EXPENSES The reasonable and necessary fees, costs and expenses (as determined by the Insurer at its sole discretion) of a Response Advisor providing Legal Services. LEGAL SERVICES The services of: (i) co–ordinating the IT Specialist or Public Relations Advisor; (ii) advising, notifying and corresponding on any notification requirements with any relevant Regulator; or (iii) monitoring complaints raised by Data Subjects and advising a Company on responses to an Insured Event for the purposes of minimising harm to the Company, including actions taken to maintain and restore public confidence in the Company, in dealing with any actual or suspected Breach of Confidential Information or Security Failure. LOSS Legal Expenses, IT Expenses, Data Recovery Expenses, Reputation Protection Expenses, Notification Expenses, Credit Monitoring and ID Monitoring Expenses, Bricking Recovery Expenses and First Response Expenses. AIG I CyberEdge® Policy Wording 05-24 | Page 8 of 47 NOTIFICATION EXPENSES The reasonable and necessary fees, costs and expenses incurred by a Company, with the Insurer’s prior written consent, of: (i) investigating and collating information; (ii) preparing notices and notifying: (a) those Data Subjects whose Personal Information is reasonably believed to have been subject to unauthorised access or disclosure; and (b) any Third Party whose Corporate Information is reasonably believed to have been subject to unauthorised access or disclosure; and (c) any relevant Regulator; and (iii) setting up and operating call centres, with regard to any actual or suspected Breach of Confidential Information. OPERATIONAL FAILURE The loss or damage to Data caused by: (i) a negligent or unintentional act or failure to act by: (a) an Insured; (b) an Employee of an Insured; or (c) a third-party service provider to an Insured; (ii) the Loss or theft of electronic equipment; or (iii) a magnetic event other than: (a) the use of electromagnetic or directed-energy weapons; or (b) the natural deterioration of the storage media or Data. PERSONAL INFORMATION Any information relating to an identified or identifiable natural person. Personal Information includes a natural person’s name, national registration identification number, telephone number, credit card or debit card number, account and other banking information, medical information, or any other information about a natural person protected under any Data Protection Legislation. PUBLIC RELATIONS ADVISOR A consultant appointed by the Insurer or the Response Advisor, or any other consultant appointed by a Company that has been approved by the Insurer in advance of such appointment, to provide Reputation Protection Services. REGULATOR A Regulator established pursuant to Data Protection Legislation in any jurisdiction and which is authorised to enforce statutory obligations in relation to the collection, disclosure, storage, processing or control of Confidential Information. Regulator includes any other government agency or authorised Data protection authority who makes a demand on a Company in relation to Data Protection Legislation. RELEVANT ENGAGEMENT A written agreement between the First Response Advisor and a Company governing the provision of the First Response Legal Services to the Company. REPUTATION PROTECTION EXPENSES The reasonable and necessary fees, costs and expenses (as determined by the Insurer at its sole discretion) of a Public Relations Advisor providing Reputation Protection Services. REPUTATION PROTECTION SERVICES Advice and support (including advice concerning media strategy and independent public relations services, and the design and management of a communications strategy) in order to mitigate or prevent the potential adverse effect of, or reputational damage from, media reporting of an Insured Event. AIG I CyberEdge® Policy Wording 05-24 | Page 9 of 47 RESPONSE ADVISOR Any law firm appointed by the Insurer, or any other law firm appointed by a Company that has been approved by the Insurer in advance of such appointment. SECURITY FAILURE (i) Any intrusion of, unauthorised access (including an unauthorised person using authorised credentials) to, or unauthorised use of (including by a person with authorised access) a Company Computer System, including that which results in or fails to mitigate any: (a) denial of service attack or denial of access; or (b) receipt or transmission of a malicious code, malicious software or virus; (ii) The Loss of Data arising from the physical theft or Loss of hardware controlled by a Company; or (iii) the unauthorised reprogramming or corruption of software (including firmware) which renders a Company Computer System or any component thereof non-functional or useless for its intended purpose. 3. Exclusions The following Exclusions are specific to this Event Management Coverage Section. They apply in addition to the Exclusions in Section 10 (Exclusions) of the General Terms and Conditions. The Insurer shall not be liable for any Loss: 3.1 BETTERMENT Consisting of the costs of: (i) updating, upgrading, enhancing or replacing a Company Computer System to a level beyond that which existed prior to the occurrence of an Insured Event, however, where Bricking Recovery Expenses Cover is Included, this Exclusion 3.1 (i) shall not apply to: (a) the patching or updating of a component of the Company Computer System required to resolve a Security Failure or Breach of Confidential Information; or (b) the replacement of a component of the Company Computer System required to restore, recreate, repair or recollect damaged, destroyed or corrupted Data which can only be reasonably replaced with an upgraded or enhanced component, but in such circumstances, only for the cost of such upgraded or enhanced component that most closely matches the functionality of the component to be replaced; (ii) removing software program errors or vulnerabilities. 3.2 BODILY INJURY AND PROPERTY DAMAGE Arising out of, based upon or attributable to any: (i) physical injury, mental illness, sickness, disease or death; or Loss, damage or destruction of tangible property, however, where Bricking Recovery Expenses Cover is Included, (ii)  this Exclusion 3.2 (ii) shall not apply to the Loss of use of electronic equipment caused by the reprogramming of the software (including firmware) of such electronic equipment rendering it useless for its intended purpose. 3.3 GOVERNMENT ENTITY OR PUBLIC AUTHORITY Arising out of, based upon or attributable to any seizure, confiscation or nationalisation of a Company Computer System by order of any government entity or public authority. 3.4 INFRASTRUCTURE Arising out of, based upon or attributable to any electrical or mechanical failure of infrastructure not under the control of a Company, including any electrical power interruption, surge, brownout or blackout, failure of telephone lines, Data transmission lines, or other telecommunications or networking infrastructure. This Exclusion 3.4 shall not apply to Loss arising out of, based upon or attributable solely to a Security Failure or Breach of Confidential Information that is caused by such electrical or mechanical failure of infrastructure. AIG I CyberEdge® Policy Wording 05-24 | Page 10 of 47 3.5 INTERNAL/STAFF COSTS Consisting of the costs of payroll, fees, benefits, overheads or internal charges of any kind incurred by a Company. 3.6 PATENT/TRADE SECRET Arising out of, based upon or attributable to any: (i) infringement of patents; (ii) Loss of rights to secure registration of patents; or (iii) misappropriation of trade secrets by or for the benefit of a Company. 3.7 WAR AND TERRORISM Arising out of, based upon or attributable to any war (whether war is declared or not), terrorism (except Cyber Terrorism), invasion, use of military force, civil war, popular or military rising, rebellion or revolution, or any action taken to hinder or defend against any of these events. 4. Conditions The following conditions are specific to this Event Management Coverage Section and shall apply in addition to the conditions (including notice provisions) set out within the General Terms and Conditions. 4.1 FIRST RESPONSE NOTIFICATION The cover provided for First Response Expenses is granted solely with respect to a Breach of Confidential Information or Security Failure first Discovered during the Policy Period and a Company shall, as a condition precedent to the obligations of the Insurer in respect of such First Response Expenses, notify the Insurer by contacting the Emergency Number specified in the schedule as soon as reasonably practicable after the Breach of Confidential Information or Security Failure first occurs. AIG I CyberEdge® Policy Wording 05-24 | Page 11 of 47 Network Interruption Coverage 1. Insurance Covers 1.1 NETWORK INTERRUPTION LOSS The Insurer will, with regard to an Insured Event which first occurs during the Policy Period, pay to each Company: Network Loss which results from the Insured Event and which the Company incurs during the Insured Event (but, if (i)  the Insured Event lasts longer than 120 days, only during the first 120 days of the Insured Event); and Network Loss which results from the Insured Event and which the Company incurs during the 90 days following (ii)  resolution of the Insured Event. 1.2 INTERRUPTION AND MITIGATION COSTS The Insurer will pay, to or on behalf of each Company, Network Interruption Costs incurred in mitigating the impact of  an Insured Event which first occurs during the Policy Period. 1.3 LOSS PREPARATION COSTS If Loss Preparation Costs Cover is Included, the Insurer will pay to or on behalf of each Company, Loss Preparation  Costs incurred as a result of an Insured Event which first occurs during the Policy Period. 2. Definitions The following definitions are specific to this Network Interruption Coverage Section. All other definitions set out within Section 9 (Definitions) of the General Terms and Conditions shall apply as stated. COMPANY COMPUTER SYSTEM (i) Any computer hardware, software or any other components thereof that are linked together through a network of two or more devices accessible through the internet or an intranet or that are connected through Data storage or other peripheral devices which are owned, operated, controlled or leased by a Company; or (ii) any of the foregoing computer hardware, software or components thereof which is part of an industrial control system, including a supervisory control and Data. CYBER TERRORISM The premeditated use of disruptive activities against a Company Computer System or network, or the explicit threat to use such activities, by an individual or group of individuals, whether acting alone or on behalf of or in connection with any entity or government, in each case with the intention to cause harm, further social, ideological, religious, political or similar objectives, or to intimidate any person(s) in furtherance of such objectives. Cyber Terrorism does not include any such activities which are part of or in support of any use of military force or war. INCREASED COSTS OF WORKING Expenses (including overtime of Employees) incurred over and above normal operating expenses in order to ensure continuation of the normal business operations of a Company and to reduce its Loss of business income. INSURED A Company. INSURED EVENT (i) If Security Failure Cover is Included, a Material Interruption to a Company Computer System that is caused by a Security Failure; (ii) if System Failure Cover is Included, a Material Interruption to a Company Computer System that is caused by a System Failure; (iii) if Voluntary Shutdown Cover is Included, a Material Interruption to a Company Computer System that is caused by a Voluntary Shutdown; (iv) if Regulatory Shutdown Cover is Included, a Material Interruption to a Company Computer System that is caused by a Regulatory Shutdown; (v) if OSP Security Failure Cover is Included, a Material Interruption to an OSP Computer System that is caused by an OSP Security Failure; and AIG I CyberEdge® Policy Wording 05-24 | Page 12 of 47 (vi) if OSP System Failure Cover is Included, a Material Interruption to an OSP Computer System that is caused by an OSP System Failure, and in each case, only where the duration of the Material Interruption exceeds the applicable Waiting Hours Period specified in the schedule. LOSS (i) for the purposes of Insurance Covers 1.1, Network Loss (ii) for the purposes of Insurance Covers 1.2, Network Interruption Costs (iii) for the purposes of Insurance Covers 1.3, Loss Preparation Costs LOSS PREPARATION COSTS Reasonable and necessary professional fees and expenses incurred by a Company with the Insurer’s prior written consent, for the services of a third-party forensic accounting firm to establish, prove, verify or quantify Network Loss or Network Interruption Costs or prepare the proof of Loss referred to in Condition 4.1 of this Network Interruption Coverage Section. MATERIAL INTERRUPTION (i) The suspension or degradation of a Company Computer System (for the purposes of Insured Event (i) – (iv)) or an OSP Computer System (for the purposes of Insured Event (v) or (vi)) causing the Company to be unable to continue the normal business operations of the Company; or (ii) the deletion, damage, corruption, alteration or Loss of or to Data on a Company Computer System (for the purposes of Insured Event (i) – (iv)) or an OSP Computer System (for the purposes of Insured Event (v) or (vi)) causing the Company to be unable to access that Data and unable to continue the normal business operations of the Company. NETWORK INTERRUPTION COSTS The reasonable and necessary costs and expenses that a Company incurs to minimise the Network Loss, or reduce the impact of a Material Interruption; provided however that the amount of Network Loss prevented or reduced must be greater than the costs and expenses incurred. NETWORK LOSS (i) A Company’s actual Loss sustained resulting from the reduction in business income calculated by taking either Network Loss Option 1 or Network Loss Option 2; and (ii) the Company’s Increased Costs of Working (but only up to an amount equal to the reduction in the business income that would have been incurred had the Company been unable to continue its normal business operations). Network Loss Option 1 (Net Profit and Continuing Fixed Costs Calculation) is calculated as follows: Take the net profit or Loss which would have been earned or incurred had the Material Interruption not occurred and add the costs (including ordinary payroll) which necessarily continue during the Material Interruption. Network Loss Option 2 (Gross Profits Calculation) is calculated as follows: Take the revenue which would have been derived from the operation of the business had the Material Interruption not occurred and subtract the variable costs, and any other costs, which do not necessarily continue during the Material Interruption. OSP COMPUTER SYSTEM Any computer hardware, software or any components thereof that are linked together through a network of two or more devices accessible through the internet or an intranet or that are connected through Data storage or other peripheral devices which are owned, operated, controlled or leased by an Outsource Service Provider. OSP SECURITY FAILURE Any intrusion of, unauthorised access (including any unauthorised person using authorised credentials) to, or unauthorised use of (including by a person with authorised access) an OSP Computer System, including that which results in or fails to mitigate any: (i) denial of service attack or denial of access; or (ii) receipt or transmission of a malicious code, malicious software or virus. AIG I CyberEdge® Policy Wording 05-24 | Page 13 of 47 OSP SYSTEM FAILURE Any unintentional and unplanned outage of an OSP Computer System such that the Outsource Service Provider is unable to provide to a Company the services described in a contract between a Company and an Outsource Service Provider pursuant to which an Outsource Service Provider provides services to a Company for a fee. OUTSOURCE SERVICE PROVIDER A Third Party that a Company has appointed to provide specified information technology services (such as the processing, hosting and storage of Data) to the Company based on an express contractual agreement, but only to the extent of the provision of such services. Outsource Service Provider does not include: (i) a public utility (including a provider of electricity, gas, water or telecommunication services); (ii) an internet service provider (including any provider of internet connectivity); or, (iii) a Securities exchange or market. REGULATORY SHUTDOWN An intentional shutdown or impairment of a Company Computer System by an Insured, necessary to comply with an enforceable legal or regulatory order pursuant to Data Protection Legislation resulting directly and solely from a Security Failure. SECURITY FAILURE (i) Any intrusion of, unauthorised access (including an unauthorised person using authorised credentials) to, or unauthorised use of (including by a person with authorised access) a Company Computer System, including that which results in or fails to mitigate any: (a) denial of service attack or denial of access; or, (b) receipt or transmission of a malicious code, malicious software or virus; or (ii) the unauthorised reprogramming or corruption of software (including firmware) which renders a Company Computer System or any component thereof non-functional or useless for its intended purpose. SYSTEM FAILURE Any unintentional and unplanned outage of a Company Computer System. VOLUNTARY SHUTDOWN A voluntary and intentional shutdown or impairment of a Company Computer System by or at the direction of: (i) the Chief Information officer or Chief Information Security Officer of a Company (or the equivalent position regardless of title) who has at least 5 years’ experience in an Information Security or Technology role; or (ii) an information technology services firm appointed by a Company that has been approved by the Insurer in advance of such appointment, after the Discovery of a Security Failure, with the reasonable belief that such shutdown or impairment would limit the Loss that would otherwise be incurred as a result of that Security Failure. AIG I CyberEdge® Policy Wording 05-24 | Page 14 of 47 3. Exclusions The following Exclusions are specific to this Network Interruption Coverage Section. They apply in addition to the Exclusions in Section 10 (Exclusions) of the General Terms and Conditions. The Insurer shall not be liable for Loss: 3.1 BETTERMENT Consisting of the costs of: (i) updating, upgrading, enhancing or replacing any component of a Company Computer System or an OSP Computer System to a level beyond that which existed prior to the occurrence of a Material Interruption; however, this exclusion shall not apply to the extent that the replacement of a component of a Company Computer System is: (a) required to end the Material Interruption; and (b) no longer available and can only be reasonably replaced with an upgraded or enhanced version; or (ii) removing software program errors or vulnerabilities. 3.2 BODILY INJURY AND PROPERTY DAMAGE Arising out of, based upon or attributable to any: (i) physical injury, mental illness, sickness, disease or death; or Loss, damage or destruction of tangible property; however, where Bricking Recovery Expenses Cover is Included, (ii)  this Exclusion 3.2 (ii) shall not apply to the Loss of use of electronic equipment caused by the reprogramming of the software (including firmware) of such electronic equipment rendering it useless for its intended purpose. 3.3 BUSINESS CONDITIONS Consisting of loss of earnings, or costs or expenses, attributable to unfavourable business conditions. 3.4 GOVERNMENT ENTITY OR PUBLIC AUTHORITY Arising out of, based upon or attributable to any seizure, confiscation or nationalisation of a Company Computer System by order of any government entity or public authority. 3.5 INFRASTRUCTURE Arising out of, based upon or attributable to any electrical or mechanical failure of infrastructure not under the control of a Company (or, where OSP Security Failure Cover or OSP System Failure Cover is Included, an Outsource Service Provider), including any electrical power interruption, surge, brownout or blackout, failure of telephone lines, Data transmission lines, or other telecommunications or networking infrastructure. 3.6 LIABILITY Arising out of, based upon or attributable to any: (i) written demand, civil, administrative or arbitral proceedings, made by any Third Parties seeking any legal remedy; or (ii) penalties paid to Third Parties. 3.7 PATENT Arising out of, based upon or attributable to any infringement of patents. 3.8 TRADING LOSSES Consisting of trading Losses, liabilities or changes in trading account value. 3.9 WAR AND TERRORISM Arising out of, based upon or attributable to any war (whether war is declared or not), terrorism (except Cyber Terrorism), invasion, use of military force, civil war, popular or military rising, rebellion or revolution, or any action taken to hinder or defend against any of these events. AIG I CyberEdge® Policy Wording 05-24 | Page 15 of 47 4. Conditions The following conditions are specific to this Network Interruption Coverage Section and shall apply in addition to the conditions set out within the General Terms and Conditions. 4.1 PROOF OF LOSS In addition to the requirements to give notice to the Insurer under Section 7.1 (Notice and Reporting) of the General Terms and Conditions, and before coverage under this Network Interruption Coverage Section shall apply, a Company must also: (i) complete and sign a written, detailed and affirmed proof of Loss after the resolution of the Material Interruption, which will include: (a) a full description of the Network Interruption Costs or Network Loss and the circumstances of such Network Interruption Costs or Network Loss; (b) a detailed calculation of any Network Loss; (c) all underlying documents and materials that reasonably relate to or form a part of the basis of the proof of the Network Interruption Costs or Network Loss; and (ii) upon the Insurer’s request promptly respond to requests for information. All adjusted claims are due and payable 45 days after: (a) the presentation of the satisfactory written proof of Network Loss and Network Interruption Costs as provided for in (i) and (ii) above; and (b) the subsequent written acceptance thereof by the Insurer. Network Loss shall be reduced by any amounts recovered by a Company (including the value of any service credits provided to a Company) from any party (including any Outsource Service Provider). The costs and expenses of establishing or proving Network Loss and/or Network Interruption Costs under this Network Interruption Coverage Section, including those associated with preparing the proof of Loss, shall be the obligation of the Company and are not covered under this policy except as covered under 1.3 (Loss Preparation Costs) of this Network Interruption Coverage Section. 4.2 APPRAISAL If a Company and the Insurer disagree on the extent of Network Loss or Network Interruption Costs, either may make  a written demand for an appraisal of such Network Loss or Network Interruption Costs. If such demand is made, each party will select a competent and impartial appraiser. The appraisers will then jointly select an expert who has not less than 10 years’ standing and who is a partner in a major international accounting firm, experienced in assessing Loss of this nature. Each appraiser will separately state the extent of Network Loss or Network Interruption Costs. If they fail to agree, they will submit their differences to the expert. Any decision by the expert will be final and binding. The Company and the Insurer will: (i) pay their own costs, including the costs of their respective chosen appraiser, and (ii) bear the expenses of the expert equally. AIG I CyberEdge® Policy Wording 05-24 | Page 16 of 47 Security and Privacy Liability Coverage 1. Insurance Covers 1.1 DATA PROTECTION INVESTIGATION AND DATA PROTECTION FINES The Insurer will pay, to or on behalf of each Company, Loss resulting from a Regulatory Investigation first occurring  during the Policy Period. 1.2 CYBER LIABILITY The Insurer will pay, to or on behalf of each Insured, Loss resulting from a Claim first made and notified during the Policy  Period resulting from any: (i) actual or alleged Breach of Confidential Information by an Insured or an Information Holder; (ii) actual or alleged Security Failure; or (iii) actual or alleged failure by a Company to notify a Data Subject or any Regulator of an unauthorised access to or unauthorised disclosure of Personal Information for which the Company is responsible in accordance with the requirements of any Data Protection Legislation, which occurred or occurs prior to or during the Policy Period. 2. Definitions The following definitions are specific to this Security and Privacy Liability Coverage Section. All other definitions set out within Section 9 (Definitions) of the General Terms and Conditions shall apply as stated. BREACH OF CONFIDENTIAL INFORMATION The unauthorised access to or unauthorised disclosure of Confidential Information. CLAIM (i) A written demand against an Insured; (ii) civil, administrative or arbitral proceedings brought against an Insured; or (iii) a PCI-DSS Assessment, provided always that the specific Insured which is the subject of the PCI-DSS Assessment was validated as compliant with the generally accepted and published Payment Card Industry Data Security Standards prior to and at the time of any Breach of Confidential Information which gives rise to such PCI-DSS Assessment occurring; seeking any legal remedy. COMPANY COMPUTER SYSTEM (i) Any computer hardware, software or any components thereof that are linked together through a network of two or more devices accessible through the internet or an intranet or that are connected through Data storage or other peripheral devices which are owned, operated, controlled or leased by a Company; (ii) any of the foregoing computer hardware, software or components thereof which is part of an industrial control system, including a supervisory control and Data acquisition (SCADA) system; (iii) any Employee “Bring Your Own Device” but only to the extent such device is used to access any of the foregoing computer hardware, software or components thereof or Data contained therein; or (iv) any cloud service or other hosted computer resources, used by a Company and operated by a Third-Party service provider under a written contract between such Third-Party service provider and a Company. CONFIDENTIAL INFORMATION Corporate Information and Personal Information in a Company’s or Information Holder’s care, custody or control or for which a Company is legally responsible. CORPORATE INFORMATION A Third Party’s items of information that are not available to the public (including trade secrets, Data, designs, forecasts, formulas, practices, processes, records, reports and documents) which are subject to contractual or legal protection. AIG I CyberEdge® Policy Wording 05-24 | Page 17 of 47 CYBER TERRORISM The premeditated use of disruptive activities against a Company Computer System or network, or the explicit threat to use such activities, by an individual or group of individuals, whether acting alone or on behalf of or in connection with any entity or government, in each case with the intention to cause harm, further social, ideological, religious, political or similar objectives, or to intimidate any person(s) in furtherance of such objectives. Cyber Terrorism does not include any such activities which are part of or in support of any use of military force or war. DAMAGES Damages that an Insured is legally liable to pay resulting from a Claim as ascertained by: (i) judgments or arbitral awards rendered against that Insured; or (ii) a settlement agreement negotiated by that Insured and for which prior written consent has been obtained from the Insurer. Damages includes punitive or exemplary or multiple damages where lawfully insurable and any monetary amounts that an Insured is required by law or has agreed by settlement to deposit into a consumer redress fund. DATA PROTECTION FINES Any lawfully insurable fines or penalties which are adjudicated by a Regulator to be payable by a Company for a breach of Data Protection Legislation. Data Protection Fines does not include any other type of civil or criminal fines and penalties. DATA PROTECTION LEGISLATION The Privacy Act 2020, and any subsequent legislation that alters, repeals or replaces such legislation and all other equivalent laws and regulations relating to the regulation and enforcement of Data protection or Data privacy in any country. DATA SUBJECT Any natural person whose Personal Information has been either collected, stored or processed by or on behalf of a Company. DEFENCE COSTS Reasonable and necessary legal fees, costs and expenses which an Insured incurs with the prior written consent of the Insurer in relation to the investigation, response, defence, appeal or settlement of a Claim or Regulatory Investigation, including court attendance costs incurred by or on behalf of that Insured. Defence Costs does not include the remuneration of any Insured, cost of their time or any other costs or overheads of any Insured. INFORMATION HOLDER A Third Party that holds Personal Information or Corporate Information on behalf of a Company. INSURED (i) A Company; (ii) a natural person who was, is or during the Policy Period becomes a principal, partner, director, officer or Employee of a Company; or (iii) a natural person who is an independent contractor, temporary contract labourer, self–employed person, or labour–only subcontractor, under the direction and direct supervision of a Company but only in relation to the services provided to that Company. Insured includes the estate, heirs or legal representatives of a deceased, legally incompetent or bankrupt Insured referred to in (ii) above to the extent that a Claim is brought against them solely by reason of them having an interest in property that is sought to be recovered in a Claim against such Insured referred to in (ii) above. INSURED EVENT A Claim or a Regulatory Investigation. LOSS (i) For the purposes of Insurance Cover 1.1, Defence Costs and Data Protection Fines; (ii) for the purposes of Insurance Cover 1.2, Damages, Defence Costs and any amounts payable in connection with a PCI-DSS Assessment. AIG I CyberEdge® Policy Wording 05-24 | Page 18 of 47 Loss does not include: (a) non–compensatory or multiple Damages (except to the extent covered as Damages or as part of a PCI-DSS Assessment) or liquidated Damages; (b) fines or penalties (except Data Protection Fines to the extent covered in 1.1. (Data Protection Investigation and Data Protection Fines)); (c) the costs and expenses of complying with any order for, grant of or agreement to provide injunctive or other non– monetary relief; or (d) an Insured’s remuneration, cost of management or staff time or overheads. PCI–DSS ASSESSMENT Any written demand received by a Company from a payment card association (e.g., MasterCard, Visa, American Express) or bank or servicer processing payment card transactions (e.g., an “acquiring bank” or “payment processor”) for a monetary amount (including fraud recovery, operational reimbursement, reimbursement of card reissuance costs and contractual fines and penalties) where: (i) a Company has contractually agreed to indemnify such Payment Card Association, bank or servicer processing payment card transactions for any monetary assessment made in connection with a Company’s obligations under the Payment Card Industry Data Security Standards, including such contractual obligations contained in a merchant services agreement or similar agreement; and (ii) such monetary assessment arises out of a Breach of Confidential Information. PERSONAL INFORMATION Any information relating to an identified or identifiable natural person. Personal Information includes a natural person’s name, national registration identification number, telephone number, credit card or debit card number, account and other banking information, medical information, or any other information about a natural person protected under any Data Protection Legislation. REGULATOR A Regulator established pursuant to Data Protection Legislation in any jurisdiction and which is authorised to enforce statutory obligations in relation to the collecting, disclosing, storing, processing or control of Confidential Information. Regulator includes any other government agency or authorised Data protection authority who makes a demand on the Insured in relation to Data Protection Legislation. REGULATORY INVESTIGATION Any formal or official action, investigation, inquiry or audit by a Regulator against a Company once it is identified in writing by a Regulator, which arises out of the use or suspected misuse of Personal Information or any aspects of the control, collection, storage or processing of Personal Information or delegation of Data processing to an Information Holder, which is regulated by Data Protection Legislation. Regulatory Investigation does not include any industry-wide, non-firm specific action, investigation, inquiry or audit. SECURITY FAILURE (i) Any intrusion of, unauthorised access (including an unauthorised person using authorised credentials) to, or unauthorised use of (including by a person with authorised access) a Company Computer System, including that which results in or fails to mitigate any: (a) denial of service attack or denial of access; or (b) receipt or transmission of a malicious code, malicious software or virus; (ii) the Loss of Data arising from the physical theft or Loss of hardware controlled by a Company; or (iii) the unauthorised reprogramming or corruption of software (including firmware) which renders a Company Computer System or any component thereof non-functional or useless for its intended purpose. AIG I CyberEdge® Policy Wording 05-24 | Page 19 of 47 3. Exclusions The following Exclusions are specific to this Security and Privacy Liability Coverage Section. They apply in addition to the Exclusions in Section 10 (Exclusions) of the General Terms and Conditions. The Insurer shall not be liable for Loss arising out of, based upon or attributable to: 3.1 ANTI–TRUST Any actual or alleged antitrust violation, restraint of trade, unfair competition or unfair or deceptive business practices, including violation of any consumer protection law. This Exclusion shall not apply to a Regulatory Investigation alleging such antitrust violation, restraint of trade, unfair competition or unfair or deceptive business practices, including violation of any consumer protection law, directly in connection with a Security Failure or Breach of Confidential Information. 3.2 ASSUMED LIABILITY, GUARANTEE, WARRANTY Any guarantee, warranty, contractual term or liability assumed or accepted by an Insured under any contract or agreement except to the extent such liability would have attached to the Insured in the absence of such contract or agreement. This Exclusion shall not apply to: (i) a contractual obligation to prevent a Security Failure or Breach of Confidential Information; (ii) an obligation under a written confidentiality or disclosure agreement with a Third Party to prevent a Breach of Confidential Information; or (iii) the obligation to comply with Payment Card Industry Data Security Standards. 3.3 BODILY INJURY AND PROPERTY DAMAGE Any: (i) physical injury, mental illness, sickness, disease or death: however, this Exclusion 3.3 (i) shall not apply in respect of emotional distress or mental anguish arising solely out of a Breach of Confidential Information; or Loss, damage or destruction of tangible property. (ii)  3.4 EMPLOYMENT PRACTICES LIABILITY Any of a Company’s employment practices (including wrongful dismissal, discharge or termination, discrimination, harassment, retaliation or other employment–related Claim). This Exclusion shall not apply to any Claim by an individual to the extent such individual is alleging: a Breach of Confidential Information in connection with such individual’s employment or application for (i)  employment with a Company; or (ii) a failure to disclose a Security Failure or Breach of Confidential Information. 3.5 GOVERNMENT ENTITY OR PUBLIC AUTHORITY Any seizure, confiscation or nationalisation of a Company Computer System by order of any government entity or public authority. 3.6 INFRASTRUCTURE Any electrical or mechanical failure of infrastructure not under the control of a Company, including any electrical power interruption, surge, brownout or blackout, failure of telephone lines, Data transmission lines, or other telecommunications or networking infrastructure. This Exclusion shall not apply to Loss arising out of, based upon or attributable solely to a Security Failure or Breach of Confidential Information that is caused by such electrical or mechanical failure of infrastructure. 3.7 INSURED V INSURED Any Claim brought by or on behalf of an Insured against another Insured. This Exclusion shall not apply to an actual or alleged unauthorised access to or unauthorised disclosure of Personal Information of any Employee, director, principal, partner or officer. AIG I CyberEdge® Policy Wording 05-24 | Page 20 of 47 3.8 PATENT/TRADE SECRET Any: (i) infringement of patents; (ii) loss of rights to secure registration of patents; or (iii) misappropriation of trade secrets by or for the benefit of a Company. 3.9 Securities Claims Any: (i) actual or alleged violation by an Insured of any law, regulation or rule relating to the ownership, purchase, sale or offer of, or solicitation of an offer to purchase or sell, Securities; or (ii) any actual or alleged violation by an Insured of any provision of the Securities Act of 1933, the Securities Exchange Act of 1934 (each a United States of America statute) or any similar law of any jurisdiction. This Exclusion shall not apply to any Damages or Defence Costs incurred in relation to a Claim solely alleging a failure to notify a Regulator of a Breach of Confidential Information where such failure to notify is in violation of any law. 3.10 War and Terrorism Any war (whether war is declared or not), terrorism (except Cyber Terrorism), invasion, use of military force, civil war, popular or military rising, rebellion or revolution, or any action taken to hinder or defend against any of these events. AIG I CyberEdge® Policy Wording 05-24 | Page 21 of 47 Digital Media Content Liability Coverage 1. Insurance Covers 1.1 DIGITAL MEDIA CONTENT LIABILITY The Insurer will pay, on behalf of each Insured, Loss resulting from a Claim first made during the Policy Period arising  from Digital Media Activities. 2. Definitions The following definitions are specific to this Digital Media Content Liability Coverage Section. All other definitions set out within Section 9 (Definitions) of the General Terms and Conditions shall apply as stated. BREACH OF CONFIDENTIAL INFORMATION The unauthorised access to or unauthorised disclosure of Confidential Information. CLAIM (i) A written demand against an Insured; or (ii) civil, administrative or arbitral proceedings brought against an Insured, seeking any legal remedy for a Wrongful Act. DAMAGES Damages that an Insured is legally liable to pay resulting from a Claim as ascertained by: (i) judgments or arbitral awards rendered against that Insured; (ii) monies payable by that Insured pursuant to any settlement agreement negotiated by that Insured and for which prior written consent has been obtained from the Insurer. Damages includes punitive or exemplary or multiple Damages where lawfully insurable. DEFENCE COSTS Reasonable and necessary fees, costs and expenses which an Insured incurs with the prior written consent of the Insurer, in relation to the investigation, response, defence, appeal or settlement of a Claim, including court attendance costs incurred by or on behalf of that Insured. Defence Costs does not include the remuneration of any Insured, cost of their time or any other costs or overheads of any Insured. DIGITAL MEDIA ACTIVITIES The posting on the Company’s website or social media outlets, of any Digital Media. DIGITAL MEDIA Any digitised content, including text, graphics, audio and video, that can be transmitted over the internet or computer networks. INSURED (i) A Company; (ii) a natural person who was, is or during the Policy Period becomes a principal, partner, director, officer or Employee of a Company; (iii) an independent contractor, temporary contract labourer, self–employed person or labour–only subcontractor, under the direction and direct supervision of a Company, but only in relation to the Digital Media Activities they undertake for that Company; (iv) a joint venture where a Company maintains operational control, but only to the extent of the Company’s interest in such joint venture; and (v) a natural person or entity which a Company is required by contract to add as an Insured under this policy, but only when and to the extent such natural person is acting on behalf of that Company; provided that such organisation or person shall only be covered under this Digital Media Content Liability Coverage Section in respect of Loss arising from a Wrongful Act when undertaking Digital Media Activities in the foregoing capacities. Insured includes the estate, heirs or legal representatives of a deceased, legally incompetent or bankrupt Insured referred to in (ii) above to the extent that a Claim is brought against them solely by reason of them having an interest in property that is sought to be recovered in a Claim against such Insured referred to in (ii) above. AIG I CyberEdge® Policy Wording 05-24 | Page 22 of 47 INSURED EVENT A Claim. INTELLECTUAL PROPERTY Copyright, trademark, service mark, design rights, know-how, database rights, registered domain or any other Intellectual Property, but not including patents or trade secrets. LOSS Damages and Defence Costs; Loss does not include: (i) non–compensatory or multiple Damages (except to the extent covered as Damages) or liquidated Damages; (ii) fines or penalties; (iii) the costs and expenses of complying with any order for, grant of or agreement to provide injunctive or other non–monetary relief; (iv) discounts, service credits, rebates, price reductions, coupons, prizes, awards or other contractual or non–contractual incentives, promotions or inducements offered to an Insured’s customers or Clients; (v) production costs or the cost of recall, reproduction, reprinting, return or correction of Digital Media by any person or entity; or (vi) any Insured’s remuneration, cost of time or overheads. WRONGFUL ACT Any actual or alleged: (i) defamation, including libel, slander, disparagement of trade reputation or the character of any person or organisation, or infliction of emotional distress or mental anguish arising from the foregoing; (ii) unintentional infringement of copyright, title, slogan, trademark, trade name, trade dress, mark, service mark, service name, or domain name; (iii) plagiarism, piracy or misappropriation or theft of ideas or information; (iv) invasion, infringement or interference with rights of privacy, publicity, morals, false light, public disclosure of private facts, intrusion and commercial appropriation of name, persona or likeness; or (v) passing-off but only if alleged in conjunction with any of the acts listed in (i) – (iv) above, on or after the Retroactive Date and prior to the end of the Policy Period in the course of undertaking Digital Media Activities. AIG I CyberEdge® Policy Wording 05-24 | Page 23 of 47 3. Exclusions The following Exclusions are specific to this Security and Privacy Liability Coverage Section. They apply in addition to the Exclusions in Section 10 (Exclusions) of the General Terms and Conditions. The Insurer shall not be liable for Loss arising out of, based upon or attributable to: 3.1 ANTI–TRUST Any actual or alleged antitrust violation, restraint of trade, unfair competition or unfair or deceptive business practices, including violation of any consumer protection law. 3.2 ASSUMED LIABILITY, GUARANTEE, WARRANTY Any: (i) guarantee or express warranty made by an Insured; or (ii) contractual liability or other obligation assumed or accepted by an Insured. 3.3 BODILY INJURY AND PROPERTY DAMAGE Any: (i) physical injury, mental illness, sickness, disease or death; or (ii) damage to or loss of or destruction of tangible property or loss of use thereof. 3.4 EMPLOYMENT PRACTICES LIABILITY Any of a Company’s employment practices (including wrongful dismissal, discharge or termination, discrimination, harassment, retaliation or other employment-related Claim). 3.5 FINANCIAL DATA Any: (i) misleading, deceptive or fraudulent financial Data; or (ii) errors made in any financial Data, that the Company publicises including the Company’s annual report and accounts and any communications  to the stock market. 3.6 GOODS, PRODUCTS OR SERVICES Any: (i) false advertising or misrepresentation in advertising of a Company’s products or services; (ii) any failure of goods, products or services to conform with an advertised quality or performance; or (iii) infringement of trademark, trade name, trade dress, mark, service mark or service name by any goods, products or services displayed or contained in any Digital Media. 3.7 GOVERNMENT/REGULATORY ACTION Any government, regulatory, licensing or commission action or investigation. 3.8 INFRASTRUCTURE Any: (i) mechanical failure; (ii) electrical failure, including any electrical power interruption, surge, brownout or blackout; or (iii) telecommunications failure. AIG I CyberEdge® Policy Wording 05-24 | Page 24 of 47 3.6 GOODS, PRODUCTS OR SERVICES Any: (i) false advertising or misrepresentation in advertising of a Company’s products or services; (ii) any failure of goods, products or services to conform with an advertised quality or performance; or (iii) infringement of trademark, trade name, trade dress, mark, service mark or service name by any goods, products or services displayed or contained in any Digital Media. 3.7 GOVERNMENT/REGULATORY ACTION Any government, regulatory, licensing or commission action or investigation. 3.8 INFRASTRUCTURE Any: (i) mechanical failure; (ii) electrical failure, including any electrical power interruption, surge, brownout or blackout; or (iii) telecommunications failure. 3.9 INSURED V INSURED Any Claim brought by or on behalf of an Insured against another Insured except a Claim by an Insured which directly  results from another Claim by a Third Party first made during the Policy Period and covered by this Digital Media Content Liability Coverage Section. 3.10 INTENTIONAL INFRINGEMENT OF INTELLECTUAL PROPERTY Any intentional infringement of Intellectual Property. 3.11 INTERNAL MESSAGING SERVICES Any publication or broadcast of Digital Media posted or transmitted on any of the Company’s internal instant message system, intranet, messaging boards, or chat rooms. 3.12 OVER-REDEMPTION Any price discounts, prizes, awards or other consideration given in excess of the total contracted or expected amount. 3.13 OWNERSHIP RIGHTS Any Claim against the Company brought by or on behalf of any independent contractor, third-party distributor, licensee,  sub-licensee, joint venture, venture partner, any Employee of the foregoing, or any Employee or agent of the Company arising out of, based upon or attributable to disputes over: (i) the ownership or exercise of rights in Digital Media; or, (ii) services supplied by such independent contractor, third-party distributor, licensee, sub-licensee, joint venturer, venture partner or Employee or agent. 3.14 PATENT/TRADE SECRET Any: (i) infringement of patents; (ii) Loss of rights to secure registration of patents; or (iii) misappropriation of trade secrets. 3.15 ROYALTIES AND OTHER MONIES Any: (i) accounting or recovery of profits, royalties, fees or other monies claimed to be due from an Insured; or (ii) licensing fees or royalties ordered, directed or agreed to be paid by an Insured pursuant to a judgment, arbitration award, settlement agreement or similar order or agreement, for the continued use of a person or entity’s copyright, trademark, service mark, design rights, know-how, database rights, registered domain or any other Intellectual Property. AIG I CyberEdge® Policy Wording 05-24 | Page 25 of 47 3.16 SECURITIES CLAIMS Any: (i) actual or alleged violation by an Insured of any law, regulation or rule relating to the ownership, purchase, sale or offer of, or solicitation of an offer to purchase or sell, Securities; (ii) any actual or alleged violation by an Insured of any provision of the Securities Act of 1933, the Securities Exchange Act of 1934 (each a United States of America statute) or any similar law of any jurisdiction; or (iii) any actual or alleged violation by an Insured of the Racketeer Influenced and Corrupt Organisation Act 18 USC Section 1961 et seq (a United States of America statute) and any amendments thereto or any Rule or Regulation promulgated thereunder. 3.17 Trade Debts Any: (i) trading debt incurred by an Insured; or (ii) guarantee given by an Insured for a debt. 3.18 Trading Losses/Monetary Value Any trading Losses or trading liabilities, monetary value of any electronic fund transfers or transfers by or on behalf  of an Insured. 3.19 War and Terrorism Any war (whether war is declared or not), terrorism, invasion, use of military force, civil war, popular or military rising, rebellion or revolution, or any action taken to hinder or defend against any of these events. AIG I CyberEdge® Policy Wording 05-24 | Page 26 of 47 Cyber Extortion Coverage 1. Insurance Covers 1.1 CYBER EXTORTION The Insurer will pay, to or on behalf of each Company, Loss that the Company incurs solely as a  result of an Extortion Threat which first occurs during the Policy Period. 2. Definitions The following definitions are specific to this Cyber Extortion Coverage Section. All other definitions set out within Section 9 (Definitions) of the General Terms and Conditions shall apply as stated. BREACH OF CONFIDENTIAL INFORMATION The unauthorised access to or unauthorised disclosure of Confidential Information. COMPANY COMPUTER SYSTEM (i) Any computer hardware, software or any components thereof that are linked together through a network of two or more devices accessible through the internet or an intranet or that are connected through Data storage or other peripheral devices which are owned, operated, controlled or leased by a Company; (ii) any of the foregoing computer hardware, software or components thereof which is part of an industrial control system, including a supervisory control and Data acquisition (SCADA) system; or (iii) any Employee “Bring Your Own Device” but only to the extent such device is used to access any of the foregoing computer hardware, software or components thereof or Data contained therein. CONFIDENTIAL INFORMATION Corporate Information and Personal Information in a Company’s or Information Holder’s care, custody or control or for which a Company is legally responsible. CORPORATE INFORMATION A Third Party’s items of information that are not available to the public (including trade secrets, Data, designs, forecasts, formulas, practices, processes, records, reports and documents) which are subject to contractual or legal protection. CYBER EXTORTION EXPENSES The reasonable and necessary fees, costs and expenses of any firm appointed by the Insurer or any other firm appointed by the Company that has been approved by the Insurer in advance of such appointment to provide the Cyber Extortion Services. CYBER EXTORTION SERVICES (i) Conducting an investigation to determine the validity, cause and scope of an Extortion Threat; (ii) advising on the response to an Extortion Threat; (iii) containing or resolving the disruption of the operations of a Company Computer System caused by the Extortion Threat; or (iv) assisting a Company in negotiating a resolution to an Extortion Threat. CYBER TERRORISM The premeditated use of disruptive activities against a Company Computer System or network, or the explicit threat to use such activities, by an individual or group of individuals, whether acting alone or on behalf of or in connection with any entity or government, in each case with the intention to cause harm, further social, ideological, religious, political or similar objectives, or to intimidate any person(s) in furtherance of such objectives. Cyber Terrorism does not include any such activities which are part of or in support of any use of military force or war. AIG I CyberEdge® Policy Wording 05-24 | Page 27 of 47 EXTORTION THREAT Any threat or connected series of threats made to the Company, for the purpose of demanding payment or transfer of Money, Securities or other tangible or intangible property of value from a Company, to: (i) commit or continue a Breach of Confidential Information; (ii) commit or continue an intentional attack against a Company Computer System (including through the use of ransomware); or (iii) disclose information concerning a vulnerability in a Company Computer System. INFORMATION HOLDER A Third Party that holds Personal Information or Corporate Information on behalf of a Company. INSURED A Company. INSURED EVENT An Extortion Threat. LOSS (i) Any payment of cash, monetary instrument, Cryptocurrency (including the costs to obtain such Cryptocurrency) or the fair market value of any property which a Company has paid, to prevent continuation of, or end, an Extortion Threat; and (ii) Cyber Extortion Expenses. PERSONAL INFORMATION Any information relating to an identified or identifiable natural person. Personal Information includes a natural person’s name, national registration identification number, telephone number, credit card or debit card number, account and other banking information, medical information, or any other information about a natural person protected under any Data Protection Legislation. AIG I CyberEdge® Policy Wording 05-24 | Page 28 of 47 3. Exclusions The following Exclusions are specific to this Cyber Extortion Coverage Section. They apply in addition to the Exclusions in Section 10 (Exclusions) of the General Terms and Conditions. The Insurer shall not be liable for any Loss: 3.1 ANTI-TERRORISM LEGISLATION To the extent that the provision of such payment to or on behalf of a Company would expose the Insurer, its parent Company or its ultimate controlling entity to any applicable anti-terrorism legislation or regulation under United Nations resolutions, and laws or regulations of the European Union, or the United States of America or the United Kingdom. 3.2 BODILY INJURY AND PROPERTY DAMAGE For any: (i) physical injury, mental illness, sickness, disease or death; or (ii) loss, damage or destruction of tangible property. 3.3 GOVERNMENT ENTITY OR PUBLIC AUTHORITY Arising out of, based upon or attributable to a regulatory or enforcement threat or demand by any government entity or public authority. 3.4 PATENT Arising out of, based upon or attributable to any infringement of patents. 3.5 WAR AND TERRORISM Arising out of, based upon or attributable to any war (whether war is declared or not), terrorism (except Cyber Terrorism), invasion, use of military force, civil war, popular or military rising, rebellion or revolution, or any action taken to hinder or defend against any of these events. AIG I CyberEdge® Policy Wording 05-24 | Page 29 of 47 Cyber Crime Coverage 1. Insurance Covers 1.1 IMPERSONATION FRAUD COVERAGE The Insurer will pay, to or on behalf of each Company, Impersonation Fraud Loss incurred as a result of an Insured  Event which is Discovered by the Insured during the Policy Period. 1.2 FUNDS TRANSFER FRAUD COVERAGE Cover provided under this Insurance Cover 1.1 shall be subject to the condition that the Fraudulent Instruction was Verified prior to the Impersonation Fraud Loss. 1.3 COMPUTER FRAUD COVERAGE The Insurer will pay, to or on behalf of each Company, Funds Transfer Fraud Loss incurred as a result of an Insured  Event which is Discovered by the Insured during the Policy Period. 1.4 TELEPHONE USAGE FRAUD COVERAGE The Insurer will pay to or on behalf of each Company, Telephone Usage Fraud Loss incurred as a result of an Insured  Event which is Discovered by the Insured during the Policy Period. 1.5 CRYPTOJACKING FRAUD COVERAGE The Insurer will pay, to or on behalf of each Company, Cryptojacking Fraud Loss incurred as a result of an Insured Event  which is Discovered by the Insured during the Policy Period. 2. Definitions The following definitions are specific to this Cyber Crime Coverage Section. All other definitions set out within Section 9 (Definitions) of the General Terms and Conditions shall apply as stated. ASSETS Money, Securities or other tangible property owned by the Insured or held by the Insured, whether pursuant to a written contract or not. Assets do not include income, interest or dividends that was not in fact earned or that potentially could have been earned by the Insured on such Money, Securities or other tangible property. ASSOCIATE A director, officer, partner, member, sole proprietor or other Employee. CLIENT Any person, firm, Company, corporation, organization, association or other entity to whom the Insured provides goods or services for a fee pursuant to a legally binding contract that pre-exists the date of Discovery of the Loss that is the subject of the Insured’s Claim. COMPUTER FRAUD The unlawful taking of Assets under the direct or indirect control of an Insured’s Computer System by means of: (i) the fraudulent accessing of such Computer System; (ii) the insertion of fraudulent Data or instructions into such Computer System; or (iii) the fraudulent alteration of Data, programs, or routines in such Computer System. COMPUTER FRAUD LOSS The theft of the Insured’s own Assets resulting directly from Computer Fraud by a single act or a series of related acts. AIG I CyberEdge® Policy Wording 05-24 | Page 30 of 47 COMPUTER SYSTEM (i) Any computer hardware, software or any components thereof that are linked together through a network of two or more devices accessible through the Internet, internal network or connected with Data storage or other peripheral devices (including, without limitation, wireless and mobile devices), and are under ownership, operation or control of, or leased by, a Company; or (ii) any cloud service or other hosted computer resources, used by a Company and operated by a Third-Party service provider under a written contract between such Third-Party service provider and a Company. CONTROL GROUP The Insured’s directors, partners, officers, departmental directors, senior managers, trustees or equivalent. CRYPTOCURRENCY MINING The use of a Computer System to generate or validate a new unit of any Cryptocurrency and/or the initial entry for such new unit on the blockchain (or any other form of distributed ledger) of a Cryptocurrency. CRYPTOJACKING FRAUD The fraudulent use of a Computer System to perform Cryptocurrency Mining. CRYPTOJACKING FRAUD LOSS Charges for hosted computer resources and/or electricity: (i) provided to the Company by a Third-Party service provider in exchange for compensation; and (ii) incurred solely due to and as a direct result of Cryptojacking Fraud by a single act or series of related acts. DISCOVERY/DISCOVERED (i) when any of the Control Group or the risk management department, internal audit department, or human resources/ personnel department (or functional equivalent) of the Insured first has knowledge of any act, omission or event which could reasonably be foreseen to give rise to a Loss covered under this Cyber Crime Coverage Section, even though the exact amount or details of such Loss, act, omission or event are not known at the time of Discovery; or (ii) when a Claim is first made against the Insured alleging that the Insured is liable to a Third Party under circumstances which, if true, would cause a reasonable person to believe that a direct financial Loss of the kind covered by this policy would be incurred. Such Discovery shall constitute Discovery by every Insured. FINANCIAL INSTITUTION (i) A banking, savings or thrift institution; or (ii) a stockbroker, mutual fund, liquid assets fund or similar investment institution. FRAUDULENT INSTRUCTION An instruction received and relied upon by the Insured or an Employee of the Insured which was transmitted: (i) by a person purporting to be an Associate of the Insured, who was authorized by the Insured to instruct Employees of the Insured to transfer, pay or deliver Funds – or by an individual acting in collusion with such purported Associate – but which was in fact fraudulently transmitted by someone else without the knowledge of an Associate of the Insured; or (ii) by a person purporting to be an Associate of a Vendor or Client of the Insured – or by an individual acting in collusion with such purported Associate – but which was in fact fraudulently transmitted by someone else without the knowledge of the Insured; provided, however, Fraudulent Instruction shall not include any such instruction transmitted by an Associate of the Vendor or Client who was acting in collusion with any Third Party in submitting such instruction. FRAUDULENTLY-INDUCED TRANSFER An instruction directing a Financial Institution to transfer, pay or deliver Funds from a Transfer Account, communicated by the Insured or an Employee of the Insured and based upon a Fraudulent Instruction. FUNDS A credit balance in a Transfer Account. AIG I CyberEdge® Policy Wording 05-24 | Page 31 of 47 FUNDS TRANSFER FRAUD Fraudulent electronic, e-mail, telegraphic, cable, teletype, telefacsimile, or telephone instructions issued to a Financial Institution to debit a Transfer Account and to transfer, pay or deliver Funds from said Transfer Account which instructions purport to have been transmitted by the Insured or by a person duly authorized by the Insured to issue such instructions but which have been fraudulently transmitted by someone else. FUNDS TRANSFER FRAUD LOSS The direct deprivation of the Insured of Funds resulting directly from Funds Transfer Fraud by a single act or a series of related acts. IMPERSONATION FRAUD LOSS The direct deprivation of the Insured of Funds resulting directly from Fraudulently-Induced Transfers by a single act or a series of related acts. INSURED A Company. INSURED EVENT (i) In respect of 1.1 Impersonation Fraud Coverage, Fraudulently-Induced Transfer; (ii) in respect of 1.2 Funds Transfer Fraud Coverage, Funds Transfer Fraud; (iii) in respect of 1.3 Computer Fraud Coverage, Computer Fraud; (iv) in respect of 1.4 Telephone Usage Fraud Coverage, a Telephone Hack; and (v) in respect of 1.5 Cryptojacking Fraud Coverage, a Cryptojacking Fraud. LOSS An Impersonation Fraud Loss, Funds Transfer Fraud Loss, Computer Fraud Loss, Telephone Usage Fraud Loss or Cryptojacking Fraud Loss. MONEY Currency, coins, bank notes and bullion, traveller’s cheques, registered checks and Money orders held for sale to the public. PREMISES The Premises from where the Company conducts its normal business operations. SECURITIES All negotiable and non-negotiable instruments or contracts representing either Money or property and include revenue and other stamps in current use, tokens and tickets, but do not include Money. TRANSFER ACCOUNT An account, maintained by the Insured at a Financial Institution, from which the Insured or the Insured’s authorized representatives may cause the transfer, payment or delivery of Funds: (i) by means of electronic, e-mail, telegraphic, cable, teletype, telefacsimile or telephone instructions (communicated directly or through a cash management service or Funds transfer system); or (ii) by means of written instructions establishing the conditions under which such transfers are to be initiated by such Financial Institution through an electronic Funds transfer system. TELEPHONE HACK Unauthorised access and use of the Company Telephone System(s) located on the Premises regardless of whether such access and use is initiated on or off such Premises. TELEPHONE SYSTEM(S) A PBX or electronic key Telephone System, with or without adjuncts including voice mail, auto attendants and automated call directors, that is owned operated, controlled or exclusively leased by the Company. TELEPHONE USAGE FRAUD LOSS Call charges incurred within forty-five (45) days from the date on which the first call charge was made, that the Company is liable for as a result of an Insured Event. AIG I CyberEdge® Policy Wording 05-24 | Page 32 of 47 VENDOR Any person, firm, Company, corporation, organization, association or other entity that provides goods or services to the Insured pursuant to a legally binding relationship that pre-exists the date of Discovery of the Loss that is the subject of the Insured’s Claim. VERIFIED Confirmation of the genuineness of a person, who communicated the Fraudulent Instruction, verified independently from the person who communicated the Fraudulent Instruction and confirmed by the Insured: (i) through a telephone call back procedure consisting of calling the requestor by using the telephone number of such requestor which is: (a) held on file by the Insured; (b) available in the internal phone directory of the Insured; or (c) verifiable into the public domain, or (ii) where such instruction is in the form of an e-mail, by verifying and ensuring that the genuine requestors’ work e-mail address has been used for such instruction. AIG I CyberEdge® Policy Wording 05-24 | Page 33 of 47 3. Exclusions The following Exclusions are specific to this Cyber Crime Coverage Section. They apply in addition to the Exclusions in Section 9 (Exclusions) of the General Terms and Conditions. The coverage afforded by this Coverage Section does not apply to: 3.1 PRIOR OR SUBSEQUENT DISCOVERY OF LOSS Loss resulting from any Insured Event: (i) Discovered prior to the inception date of the Policy Period; or (ii) Discovered after the expiry of the Policy Period. 3.2 INSURED CONDUCT  Loss resulting from theft or any other fraudulent, dishonest or criminal act by the Insured, or any partner, owner, trustee, governor, management committee members, members of the management board, director, Employee or leased worker of the Insured, whether acting alone or in collusion with others. 3.3 CLIENT OR VENDOR CONDUCT  Loss resulting from theft or any other fraudulent, dishonest or criminal act by a Client or Vendor, or any partner, owner, trustee, governor, management committee members, members of the management board, director, Employee or leased worker of a Client or Vendor, whether acting alone or in collusion with others. 3.4 DEFENCE AND PROSECUTION COSTS The costs of defending any legal proceeding brought against the Insured, or the fees, costs or expenses incurred or paid by the Insured in prosecuting or defending any legal proceeding. 3.5 WAR AND TERRORISM  Loss arising out of, based upon or attributable to any war (whether war is declared or not), terrorism (except Cyber Terrorism), invasion, use of military force, civil war, popular or military rising, rebellion or revolution, or any action taken to hinder or defend against any of these events. Cyber Terrorism does not include any such activities which are part of or in support of any use of military force or war. 3.6 CARD LOSS  Loss resulting directly or indirectly from the actual or alleged use of credit, debit, charge, access, electronic benefit transfer, convenience, cash management or other cards. 3.7 REVERSED OR RETURNED LOSS  Loss to the extent that such Loss has been reversed or returned by a credit card Company or Financial Institution. 3.8 ACCOUNTING OR ARITHMETICAL ERROR Loss arising out of accounting or arithmetical errors or omissions. 3.9 LOSS OF INCOME Loss of potential income, including interest and dividends, of the Insured, a Client, a Vendor or any Third Party. 3.10 REGULATORY AND NON-MONETARY LOSS Any fines, penalties, consequential Damages, punitive Damages, expenses as a result of regularly scheduled recurring or routine regulatory examinations, or compliance activities or non-monetary relief, including without limitation, injunctive relief, or other equitable remedies of any type for which the Insured is legally liable. 3.11 FINANCIAL INSTITUTION AND FUNDS TRANSFER LOSS  Loss resulting from any Insured Event caused by a Financial Institution, or any electronic Funds transfer system, or electronic Data processor, except to the extent that it is excess of any indemnity or other insurance provided for the benefit of customers of the Financial Institution. AIG I CyberEdge® Policy Wording 05-24 | Page 34 of 47 3.12 SURRENDER  Loss resulting from Computer Fraud arising out of the giving or surrendering of Assets in any exchange or purchase, whether legitimate or fraudulent. 3.13 PURCHASE OR SALE FROM COMPUTER FRAUD  Loss resulting from Computer Fraud which induces the Insured to make any purchase or sale, whether legitimate or fraudulent. 3.14 ERRORS AND OMISSIONS Loss resulting from Computer Fraud arising out of unintentional errors or omissions. 3.15 LOSS OF TIME OR USE Loss of computer time or use due to Computer Fraud. 3.16 LOSS AND DAMAGE TO RECORDS  Loss resulting from the Loss of or damage to manuscripts, books of account or records maintained in any format or medium. 3.17 TRADING  Loss resulting directly or indirectly from any authorized or unauthorized trading of Money, Securities or other tangible property whether or not in the name of the Insured and whether or not in a genuine or fictitious account. 3.18 INDIRECT AND CONSEQUENTIAL LOSS Loss that is an indirect or consequential result of any Insured Event including but not limited to Loss resulting from (i)  payment of Damages of any type for which the Insured is legally liable; or Loss resulting directly or indirectly from the (a) theft, disappearance or destruction of; (b) unauthorized use or (ii)  disclosure of; (c) unauthorized access to; or (d) failure to protect any: 1. confidential or non-public; or 2. personal or personally identifiable, information that any person or entity has a duty to protect under any law, rule or regulation, under any agreement, or any industry guideline or standard. Notwithstanding the foregoing, however, this exclusion shall not apply to the extent that any Insured Event results directly from the unauthorized use or disclosure of a password or other user credential information. (iii) Loss arising out of, based upon or attributable to any indirect or consequential Loss, including: any Loss of monies, Securities or financial Assets arising from the unauthorised access or use of the (a)  Company Telephone System(s); (b) any Loss arising from the Telephone System(s) being unavailable; or any Loss arising from an Insured voluntarily giving or surrendering unauthorised access to the (c)  Company Telephone System(s) through a purchase or exchange. AIG I CyberEdge® Policy Wording 05-24 | Page 35 of 47 4. Conditions The following conditions are specific to this Cyber Crime Coverage Section and shall apply in addition to the conditions set out within the General Terms and Conditions. 4.1 Notice and Discovery of Loss In addition to the provisions of Clause 7.1 Notice of the General Terms and Conditions, and before coverage will apply for Loss under this Cyber Crime Coverage Section, each Insured must also: (i) complete and sign a written, detailed and affirmed proof of Loss within sixty (60) days after the Discovery of any Loss (unless such period has been extended by the Insurer in writing) which shall include, among any other pertinent information: (a) a full description of such Loss and the circumstances surrounding such Loss, which shall include, among any other necessary information, the time, place and cause of the Loss; (b) a detailed calculation of any Loss; and (c) all underlying documents and materials that reasonably relate to or form any part of the proof of such Loss; (ii) upon the Insurer’s request, submit to an examination under oath; (iii) immediately record the specifics of any Loss and the date such Loss was Discovered; (iv) give notice to law enforcement authorities; and provide the Insurer with any cooperation and assistance that the Insurer may request, including assisting the Insurer in: (v)  (a) any investigation of a Loss or circumstance; (b) enforcing any legal rights an Insured or the Insurer may have against anyone who may be liable to an Insured; and (c) executing any documents that the Insurer deems necessary to secure its rights under this policy. The costs and expenses of establishing or proving an Insured’s Loss under this Cyber Crime Coverage Section, including, without limitation, those connected with preparing a proof of Loss, shall be such Insured’s obligation, and are not covered under this policy. 4.2 Basis of Valuation of Loss If a foreign currency (a currency other than the currency in which this policy is written) is involved in a covered Loss sustained by the Insured, then for the purpose of any required calculation in the settlement of covered Loss, the rate of exchange shall be the rate as published by the Reserve Bank on the date of Discovery of the Loss. AIG I CyberEdge® Policy Wording 05-24 | Page 36 of 47 Criminal Reward Fund Coverage 1. Insurance Covers 1.1 CRIMINAL REWARD FUND The Insurer may pay on a Company’s behalf, at the Insurer’s sole and absolute discretion, a Criminal Reward Fund. 2. Definitions The following definitions are specific to this Criminal Reward Fund Coverage Section. All other definitions set out within Section 9 (Definitions) of the General Terms and Conditions shall apply as stated. CRIMINAL REWARD FUND An amount offered by the Insurer for information that leads to the arrest and conviction of any individual(s) committing or trying to commit any illegal act related to the coverage under any of following Coverage Sections if such Coverage Sections are Included: Security and Privacy Liability Coverage Section, Network Interruption Coverage Section, Event Management Coverage Section, Cyber Extortion Coverage Section and Cyber Crime Coverage Section. INSURED EVENT The payment by the Insurer of the Criminal Reward Fund. 3. Exclusions The following Exclusions are specific to this Criminal Reward Fund Coverage Section. They apply in addition to the Exclusions in Section 10 (Exclusions) of the General Terms and Conditions and in addition to the Exclusions set out within the Data Protection and Cyber Liability Coverage Section, the Network Interruption Coverage Section, Event Management Coverage Section, Cyber Extortion Coverage Section and Cyber Crime Coverage Section. 3.1 FEES, COSTS AND EXPENSES The Insurer shall not be liable for any payment under this Criminal Reward Fund Coverage Section arising out of, based  upon or attributable to any information provided by any Insured, an Insured’s auditors, whether internal or external, any individual hired or retained to investigate the aforementioned illegal acts, or any other individuals with responsibilities for the supervision or management of the aforementioned individuals. AIG I CyberEdge® Policy Wording 05-24 | Page 37 of 47 Loss Prevention Services 1. Services 1.1 LOSS PREVENTION SERVICES The Policyholder is eligible to enrol for Loss Prevention Services. It is solely at the discretion of the Policyholder to enrol in  the Loss Prevention Services, and such enrolment shall have no impact on the Premium charged under this policy. The Policyholder can begin the enrolment process by visiting the following site: www.aig.com/cyberriskconsulting. 2 Definitions The following definitions are specific to this Loss Prevention Services Section. LOSS PREVENTION SERVICES Cyber risk management tools and services made available to the Policyholder as further described at the link set forth above. 3. Conditions The following conditions are specific to this Loss Prevention Services Section. The Insurer may modify (by adding, removing or replacing a cyber risk management tool or service) or discontinue the Loss Prevention Services at any time. The Insurer may partner with Third Party vendors to provide any or all of the Loss Prevention Services to the Policyholder. The Policyholder is only eligible for Loss Prevention Services during the Policy Period. AIG I CyberEdge® Policy Wording 05-24 | Page 38 of 47 Section B: Costs and Expenses If the Insurer (in its sole and absolute discretion) determines that any Loss covered by any other section, cover, endorsement or extension of this Policy is subject to the existence or potential existence of a Charge, the Insurer shall not be obligated to advance any costs or expenses under that section, cover, endorsement or extension of this Policy but instead the Insurer shall pay such costs and expenses solely under this Coverage Section – Costs and Expenses. 1. All costs and expenses paid, or to be paid, under this Coverage Section – Costs and Expenses shall: (a) be subject to the same terms and conditions (including any Exclusions or sublimits) which would have applied had the Insurer made payment under the applicable section, cover, endorsement or extension of this Policy which is subject to the existence or potential existence of a Charge, (b) be subject to the Limit of Liability prescribed in the Schedule or any sublimit; and (c) not include taxes other than an amount of GST for which an Insured is not entitled to an input tax credit; remuneration or employment-related benefits; Loss or any other Damages, compensation, fines or penalties; nor amounts which the Insurer is prohibited from paying by law. 2. Subject to clause 4 below, if: any Loss covered by this Policy would have been paid by the Insurer but for the existence or potential existence of (i)  a Charge; and (ii) that Loss (or any part of that Loss) has been paid to the Insured under clause 1 above; and (iii) upon the final determination of the existence and extent of any Charge the Loss (or any part of the Loss) is determined not to be, or to have been, any longer subject to any Charge and could, prior to reinstatement (if any), have been paid to the Insured under any other section, cover, endorsement or extension of this Policy; the Insurer shall as soon as practicable reinstate this Coverage Section’s Limit of Liability (without deduction or set-off)  by an amount equivalent to such Loss or part of such Loss falling within each of (a), (b) and (c) above and the Limit of Liability of the corresponding section, cover, endorsement or extension of this Policy shall be reduced by the amount of the reinstatement. 3. Subject to clause 4 below, if, prior to the final determination of the existence and extent of any Charge, the Insurer (in its sole and absolute discretion) determines that any Loss paid to the Insured under clause 1 above could, prior to reinstatement (if any), have been paid under any other section, cover, endorsement or extension of this Policy, the Insurer shall as soon as practicable reinstate this Coverage Section’s Limit of Liability by an amount equivalent to such Loss (without deduction or set-off) and any such amounts reinstated under this clause shall apply in reduction of any reinstatement under clause 2 above and the Limit of Liability of the corresponding section, cover, endorsement or extension of this Policy shall be reduced by the amount of the reinstatement. 4. The maximum amount available to reinstate this Coverage Section’s Limit of Liability under clauses 2 and 3 above shall not exceed the Policy Aggregate Limit of Liability any one Claim limit (if any) stated in the Schedule. For the purposes of this Coverage Section – Costs and Expenses, Charge means a charge arising under section 9 of the Law Reform Act 1936 as amended, re-enacted or substituted from time to time and/or any other legislative provision of similar effect. AIG I CyberEdge® Policy Wording 05-24 | Page 39 of 47 Section C: General Terms and Conditions In consideration of the payment of Premium or agreement to pay the Premium, the Policyholder and the Insurer agree as follows: 1. Application of General Terms and Conditions These General Terms and Conditions shall apply to all Coverage Sections, unless a Coverage Section states specifically that all or part of these General Terms and Conditions shall not apply to that Coverage Section. The terms and conditions set forth in each Coverage Section shall only apply to that particular Coverage Section. Where there is conflict or ambiguity between these General Terms and Conditions and the terms and conditions set forth in any Coverage Section, the terms and conditions set forth in such Coverage Section shall prevail to the extent of such conflict or ambiguity. The definitions shall have the meaning given to them either in Section 9 (Definitions) of these General Terms and Conditions or in the Coverage Section they are used in. 2. Cover The Insurer will provide insurance cover as set out in those Coverage Sections which are Included. 3. Limits of Liability The total amount payable by the Insurer under this policy for the Policy Period for all Loss in the aggregate arising from all Insured Events covered by this policy shall not exceed the Policy Aggregate Limit of Liability. In respect of each Coverage Section, the total amount payable by the Insurer under this policy for the Policy Period for all Loss in the aggregate arising from all Insured Events covered by that Coverage Section shall not exceed that Coverage Section’s Coverage Section Limit of Liability. Each Coverage Section Limit of Liability is part of and not in addition to the Policy Aggregate Limit of Liability. Payments of Loss under any Coverage Section shall erode the Policy Aggregate Limit of Liability. The total amount payable by the Insurer for Loss in respect of which a sub-limit is specified in the schedule or any other provision of this policy shall not exceed that sub-limit. Sub-limits are part of and not in addition to the Policy Aggregate Limit of Liability and the Coverage Section Limit of Liability of the Coverage Section which covers the Loss. Each such sub-limit is, unless specifically stated otherwise, for the Policy Period for all Loss in the aggregate arising from all Insured Events covered by this policy. Amounts specified for the Policy Aggregate Limit of Liability, Coverage Section Limits of Liability, sub-limits and other limits are limits for all Insureds together, not limits per Insured. 4. Retentions With respect to each Single Insured Event, the Insurer shall only pay that part of Loss which exceeds the Retention. The Insurer may, in its sole and absolute discretion, advance Loss within the Retention, and, in that event, such amounts shall be reimbursed to the Insurer by the Policyholder forthwith. The Retention is to be borne by the Insureds and shall remain uninsured. In the event that a Single Insured Event triggers more than one Retention, then, as to such Single Insured Event, the highest of those Retentions shall apply with regard to the Loss. The Retentions for each Coverage Section are set out in the schedule. The application of a Retention to Loss under one Coverage Section shall not reduce the Retention applicable under any other Coverage Section. 5. Subrogation Where any amount is paid under this policy in respect of an Insured Event, the Insurer shall be subrogated to all rights of recovery of each Insured (whether or not the Insured has been fully compensated for its actual loss). The Insurer shall be entitled to pursue and enforce such rights in the name of the Insured and the Insured shall execute all papers required and shall do everything necessary to secure and preserve the rights, including the execution of the documents necessary to enable to Insurer effectively to bring suit in the name of the Insured. No Insured shall do anything to prejudice the Insurer’s rights of recovery. A Company may waive an Insured’s rights to recovery against others if such Company does so in writing and before the Insured Event occurred. AIG I CyberEdge® Policy Wording 05-24 | Page 40 of 47 6. Recoveries In the event the Insurer recovers amounts it pays under this policy, the limits and sub-limits out of which those amounts are paid shall be replenished to the extent of the recovery less any costs of recovery. Amounts recovered in excess of the Insurer’s total payment under this policy (less any costs of recovery) shall be returned to the relevant Insured. The Insurer assumes no duty to seek a recovery of any amounts paid under this policy. 7. Claims 1. NOTICE AND REPORTING It is a condition precedent to the Insurer’s liability under this policy for Loss arising from an Insured Event: that the Insurer is given written notice of that Insured Event as soon as practicable after a Company’s Responsible (i)  Officer first becomes aware of it; and that the Insurer is given written notice of any circumstances that a Company’s Responsible Officer may become (ii)  aware of and which may reasonably be expected to give rise to that Insured Event as soon as practicable following that awareness, but in all events, no later than: (a) 60 days after the end of the Policy Period; or (b) expiry of any applicable Discovery Period. A notice of circumstances which may reasonably be expected to give rise to an Insured Event must include, to the extent known after reasonable inquiry, the reasons for anticipating the Insured Event and particulars as to dates, acts and the potential Insureds and claimants concerned. Unless otherwise expressly stated, all notifications must be in writing: 1. by post and the date of posting shall constitute the date that notice was given, and proof of posting shall be sufficient proof of notice, to: New Zealand Claims Manager AIG New Zealand Insurance Limited PO Box 1745 Shortland Street Auckland 1140, or 2. by email to: finclaims@aig.com Where the First Response Cover is Included and a Company has notified the Insurer of an Insured Event by calling the Emergency Number specified in the schedule, then, provided the Insurer has acknowledged the call, the Company will be deemed to have provided written notice to the Insurer as set out in this Section 7.1 (Notice and Reporting). 2. RELATED CLAIMS, INSURED EVENTS OR CIRCUMSTANCES If a Claim, other Insured Event or circumstance is notified in writing to the Insurer as required by Section 7.1 (Notice and  Reporting) of these General Terms and Conditions, then all subsequent Claims, other Insured Events and circumstances that constitute a Single Insured Event with that notified Claim, other Insured Event or circumstance shall be: (i) deemed to have been first made (in the case of Claims), to have first occurred (in the case of other Insured Events) and to have been first notified (in the case of circumstances) at the time when that notified Claim, other Insured Event or circumstance (respectively) was first made, first occurred or was first notified; and (ii) deemed to be notified to the Insurer at the time that required or permitted notice was given. For the purposes of this Section 7.2 (Related Claims, Insured Events or Circumstances), a circumstance which may reasonably be expected to give rise to an Insured Event and which is notified in writing to the Insurer as required by Section 7.1 (Notice and Reporting) of these General Terms and Conditions shall be deemed to be an Insured Event. AIG I CyberEdge® Policy Wording 05-24 | Page 41 of 47 3. DEFENCE AND SETTLEMENT The Insurer has the right but no obligation to defend any Claim or Regulatory Investigation.  Each Insured shall have the obligation to defend and contest a Claim or Regulatory Investigation made against them  unless the Insurer, in its sole and absolute discretion, elects in writing to take over and conduct the defence and settlement of the Claim or Regulatory Investigation. If the Insurer does not so elect, it shall be entitled, but not required, to participate fully in that defence and the negotiation of any settlement that involves or appears reasonably likely to involve the Insurer making a payment under this policy. If legal representation is necessary in relation to any Insured Event, the Insurer shall select a law firm from its legal panel to provide such legal representation. Should an Insured wish to appoint a different law firm, that Insured shall make the request in writing to the Insurer prior to retaining that law firm. Such request shall include the identity of the proposed fee earners, the proposed hourly rates for each fee earner, a summary of the firm’s and those fee earners’ experience in handling similar matters and a budget for the Insured Event, and any other relevant information which the Insurer may request. The Insurer shall not be obliged to agree to the Insured’s request. The Insurer has the right at any time after notification of an Insured Event to make a payment to the Insured of the  unpaid balance of the Coverage Section Limit of Liability (or, if a sub-limit is applicable to that Insured Event, the unpaid balance of that sub-limit), and upon making such payment, all obligations of the Insurer under this policy for that Insured Event, including, if any, those relating to defence of such Insured Event, shall cease. 4. INSURER’S CONSENT No Insured shall admit or assume any liability, enter into any settlement agreement, consent to any judgment, incur any  Defence Costs or incur any other amounts where consent is required under this policy without the prior written consent of the Insurer (which shall not be unreasonably withheld or delayed, provided that the Insurer shall be entitled to exercise all of its rights under the policy). Only liabilities, settlements, judgments and Defence Costs (and other amounts where consent is required under this policy) consented to by the Insurer, and judgments resulting from Claims defended in accordance with this policy or other Insured Events handled in accordance with this policy, shall be recoverable as Loss under this policy. Notifying a Regulator of an actual or potential Breach of Confidential Information or breach of Data Protection  Legislation will not be regarded as an admission of liability for the purposes of this Section 7.4 (Insurer’s Consent). 5. INSURED’S CONSENT The Insurer may make any settlement of any Insured Event it deems expedient with respect to any Insured, subject to such  Insured’s written consent (which shall not be unreasonably withheld or delayed). If any Insured withholds or delays consent to such settlement, the Insurer’s liability for all Loss arising from such Insured Event shall not exceed the amount for which the Insurer could have settled such Insured Event, plus Defence Costs (and other costs covered by this policy in relation to that Insured Event) incurred as of the date such settlement was proposed in writing by the Insurer, less coinsurance (if any) and the applicable Retention. 6. COOPERATION Each Insured will at their own cost: (i) provide all reasonable assistance to the Insurer and co-operate in the investigation, defence, settlement or appeal of any Insured Event and the assertion of indemnification and contribution rights; (ii) use due diligence and do and concur in doing all things reasonably practicable to avoid or diminish any Loss under this policy; and (iii) give such information and assistance to the Insurer as the Insurer may reasonably require to enable it to investigate any Loss or determine the Insurer’s liability under this policy. 7. OTHER INSURANCE (i) The Network Interruption, Event Management and Cyber Extortion Coverage Sections are written on a primary basis. Each other Coverage Section shall always apply excess over any other valid and collectable: (i) insurance unless (ii)  such other insurance is expressly written to be excess over the Policy Aggregate Limit of Liability or that Coverage Section’s Coverage Section Limit of Liability; and (ii) indemnity available to the Insured. (iii) With respect to any Loss covered under this policy for which coverage is also provided by one or more other policies issued by the Insurer or any affiliate thereof, including any renewal or replacement thereof (the “Other Policy”), the most the Insurer or such affiliate shall pay under both policies combined shall not be greater than this policy’s Limit of Liability or the Other Policy’s aggregate Limit of Liability, whichever is higher. AIG I CyberEdge® Policy Wording 05-24 | Page 42 of 47  (iv) Subject to subparagraph 7.7(ii) above, if coverage for a Loss is sought by the Policyholder under both this policy and the Other Policy, the Insurer will only be liable under this policy for the Insurer’s pro-rata portion of the Loss. The Insurer’s pro-rata portion of the Loss shall not be greater than the proportion of the Loss that this policy’s applicable limit(s) of coverage bears to the total of the applicable limits of liability of both policies. Nothing in the foregoing shall be construed to increase any Sublimit of Liability, Coverage Section’s Coverage Section Limit of Liability or the Limit of Liability. 8. ALLOCATION In the event that any Insured Event involves both covered matters and matters not covered under this policy or involves persons covered and persons not covered under this policy, a fair and proper allocation of any costs of defence, Damages, judgments or settlements or other costs and expenses shall be made between each Insured and the Insurer taking into account the relative legal and financial exposures attributable to covered matters and matters not covered under this policy. 8. General Provisions CANCELLATION BY POLICYHOLDER This policy may be cancelled by the Policyholder providing written notice to the Insurer. If no Claim has been made or other actual or alleged Insured Event has occurred and no circumstance has been notified prior to such cancellation, the Insurer shall retain the pro–rata proportion of Premium due for time on risk. Otherwise, the Premium shall not be returned and shall be deemed fully earned at the inception date specified in the schedule. CANCELLATION BY INSURER This policy may be cancelled by the Insurer delivering to the Policyholder by registered, certified, other first class mail or other reasonable delivery method, at the address of the Policyholder set forth in the Schedule, written notice starting when, not less than thirty (30) days thereafter, (ten (10) days in the event of cancellation for non-payment of Premium), the cancellation shall be effective. Proof of mailing or delivery of such notice shall be sufficient proof of notice and this policy shall be deemed cancelled as to all Insureds at the date and hour specified in such notice. In such case, the Insurer shall be entitled to a pro-rata proportion of the Premium. Payment or tender of any unearned Premium by the Insurer shall not be a condition precedent to the effectiveness of cancellation, but such payment shall be made as soon as practicable. INSURED’S INSOLVENCY Insolvency, bankruptcy, winding up of any kind, administration, administrative receivership, voluntary arrangement or any other insolvency procedure of an Insured shall not relieve the Insurer of any of its obligations under this policy. AUTHORITY OF POLICYHOLDER Except as provided in Section 7.1 (Notice and Reporting) of these General Terms and Conditions, the Policyholder shall act on behalf of all Insureds with respect to all matters relevant to this policy except if and when the Policyholder is in bankruptcy, winding up of any kind, administration, administrative receivership, voluntary arrangement or any other insolvency procedure, in which case each Insured shall act on their own behalf. ASSIGNMENT This policy and any rights under or in respect of it cannot be assigned without the prior written consent of the Insurer. GOVERNING LAW This policy and any disputes or Claims arising out of or in connection with it or its subject matter or formation (including non– contractual disputes or Claims) shall be governed by and construed in accordance with the laws of New Zealand. INTERPRETATION The descriptions in the headings and titles of this policy are solely for reference and convenience and do not lend any meaning to this policy. Words and expressions in the singular shall include the plural and vice versa. All references to specific legislation include amendments to and re–enactments of such legislation and similar legislation in any jurisdiction in which a Claim is made or an Insured Event occurs. References to positions, offices or titles shall include their equivalents in any jurisdiction in which Claim is made or an Insured Event occurs. Words in bold typeface have special meaning and are defined in these General Terms and Conditions or in the applicable Coverage Section. References in this policy to the schedule or a Section mean the schedule to or a Section of this policy unless otherwise stated. Wherever the word “person” or “persons” appears in this policy, it means legal or natural person or persons unless otherwise specified. AIG I CyberEdge® Policy Wording 05-24 | Page 43 of 47 DISPUTE RESOLUTION We are committed to handling any complaints about our products or services efficiently and fairly. If you have a complaint: (i) contact your insurance intermediary and they may raise it with us; (ii) if your complaint is not satisfactorily resolved you may request that your matter be reviewed by management by writing to: The Complaints Manager AIG Insurance New Zealand Limited PO Box 1745 Shortland Street Auckland 1140 We are also a member of an independent dispute resolution scheme operated by Financial Services Complaints Limited (FSCL) and approved by the Ministry of Consumer Affairs. Your complaint will be referred to FSCL if We have reached a “deadlock” in trying to resolve it. FSCL’s contact details are info@fscl.org.nz or telephone 0800 347 257. Full details of how to access the FSCL scheme can be obtained on their website www.fscl.org.nz. There is no cost to You to use the services of FSCL. 9. Definitions Terms appearing in bold in these General Terms and Conditions and not defined in this Section 9 (Definitions) shall have the meaning ascribed to them in the applicable Coverage Section for the purposes of coverage provided under that particular Coverage Section. Certain terms may have different meanings dependent on the applicable Coverage Section. Where a term is defined in more than one Coverage Section it shall have the meaning ascribed to it in the Coverage Section in which it appears, but that meaning shall apply solely for purposes of coverage provided under that particular Coverage Section. The following terms are applicable to all Coverage Sections and shall have the meanings set out below: COMPANY The Policyholder or any Subsidiary. CONTINUITY DATE With respect to a Coverage Section or a specific Cover within a Coverage Section, the date specified in the schedule as its Continuity Date. COVERAGE SECTION A Coverage Section listed in the schedule. The Insurer will provide only the insurance cover set out in those Coverage Sections which are Included. COVERAGE SECTION LIMIT OF LIABILITY With respect to a Coverage Section, the amount specified in the schedule as its Coverage Section Limit of Liability. CRYPTOCURRENCY A digital representation of value based on the cryptographic protocol of a computer network and that is intended to be used as a medium of exchange and/or store of value. DATA Any electronically stored, digital or digitised information, including software. For the purposes of this policy, Data is not tangible property. DISCOVERY PERIOD A period immediately following the expiry of the Policy Period during which written notice may be given to the Insurer of a Claim first made during such period or the Policy Period for a Wrongful Act prior to the expiry of the Policy Period. AIG I CyberEdge® Policy Wording 05-24 | Page 44 of 47 EMPLOYEE A natural person under a contract of employment with a Company. Employee does not include any: (i) principal, partner, director or officer; or (ii) temporary contract labourer, self-employed person or labour-only sub-contractor. FULL ANNUAL PREMIUM The Premium plus any additional Premium (as annualised) charged for any endorsements applied to this policy during the Policy Period. GENERAL TERMS AND CONDITIONS This policy’s General Terms and Conditions. INCLUDED Shown in the schedule as Included. INSURER As specified in the schedule POLICY AGGREGATE LIMIT OF LIABILITY The amount specified under Policy Aggregate Limit of Liability in the schedule. POLICY PERIOD The period of time from the inception date specified in the schedule to the expiry date specified in the schedule or, if earlier, to the date of cancellation of this policy. POLICYHOLDER The entity specified under Policyholder in the schedule. POLLUTANTS Any solid, liquid, biological, radiological, gaseous or thermal irritant or containment whether occurring naturally or otherwise, including asbestos, smoke, vapour, soot, fibres, mould, spores, fungus, germs, acids, alkalis, nuclear or radioactive material of any sort, chemicals or waste. Waste includes material to be recycled, reconditioned or reclaimed. PREMIUM The Premium detailed under Premium in the schedule. RESPONSIBLE OFFICER Any Chief Executive Officer, Chief Financial Officer, Chief Compliance Officer, Chief Information Officer, Data Protection Officer, Chief Information Security Officer, Risk Manager, General Counsel or position equivalent to any of the foregoing. RETENTION With respect to a Coverage Section or Cover, the amount or amounts specified in the schedule as its Retention. RETROACTIVE DATE With respect to a Coverage Section, the date specified in the schedule as its Retroactive Date. SINGLE INSURED EVENT Any one or more Insured Events to the extent that such Insured Events arise out of, are based upon, are in connection with, or are otherwise attributable to the same originating cause or source. All such Insured Events shall be regarded as a Single Insured Event regardless of whether such Insured Events involve the same or different claimants, Insureds or causes of action. AIG I CyberEdge® Policy Wording 05-24 | Page 45 of 47 SUBSIDIARY Any entity of which the Policyholder has or had Control on or before the inception date specified in the schedule either directly or indirectly through one or more of its other Subsidiaries. Subsidiary shall also automatically include any entity of which the Policyholder acquires Control, either directly or indirectly through one or more of its other Subsidiaries during the Policy Period, provided that such acquired entity: (i) undertakes materially similar or identical business activities to the acquiring company; (ii) has no prior Claims or Losses that could otherwise be covered under this policy; (iii) has total gross revenues that are less than 10% of the total gross revenue of the Policyholder; and (iv) generates less than 50% of their total gross revenue from the United States of America. For the purposes of this definition “Control” means where the Policyholder: (a) controls the election of the majority of the board of directors of such entity; (b) controls more than half of the voting power of such entity; or (c) holds more than 50% of the issued share / equity capital of such entity. Cover under this policy for such entities which the Policyholder has acquired Control, either directly or indirectly through one or more of its other Subsidiaries during the Policy Period, shall only apply to Claims made or other Insured Events first occurring on or after the date of acquisition. Notwithstanding anything to contrary in this Policy, the applicable Retroactive Date and Continuity Date in respect of each such entity shall be the date on which the Policyholder acquired Control of the entity. THIRD PARTY Any entity or natural person except: (i) any Insured; and (ii) any other entity or natural person having a financial interest or executive role in the operation of a Company. 10. Exclusions The following Exclusions apply to all Coverage Sections and in addition to the Exclusions set out in each Coverage Section. CONDUCT The Insurer shall not be liable for Loss, arising out of, based upon, or attributable to: (i) any wilful disregard or non–compliance with a ruling, direction or injunction by a court, tribunal, arbitrator or a Regulator within the relevant jurisdiction; (ii) the committing of any dishonest, fraudulent, criminal, reckless or malicious act, error or omission, or any intentional or knowing violation of the law, if committed by: (a) any director, principal, partner or Responsible Officer of a Company, whether acting on their own or in collusion with others; or (b) any Employee acting in collusion with any of a Company’s directors, principals, partners or Responsible Officers. The Insurer will continue to pay, on behalf of the Insured, Defence Costs under this policy until either (i) or (i) above is found by a court, tribunal, arbitrator or Regulator to have been committed by the Insured. Following such finding the Insurer shall be entitled to repayment of any amount paid to the Insured under this policy. NATURAL DISASTER The Insurer shall not be liable for Loss, arising out of, based upon, or attributable to any fire, smoke, explosion, lightning, wind, water, flood, earthquake, volcanic eruption, tidal wave, landslide, hail, Act of God or any natural event howsoever caused. POLLUTION The Insurer shall not be liable for Loss, arising out of, based upon, or attributable to: (i) the actual, alleged or threatened discharge, dispersal, seepage, release, migration or escape of Pollutants; (ii) any direction, request or effort to test for, monitor, clean up, remove, contain, treat, detoxify or neutralise Pollutants or respond to or assess the effects of Pollutants; or (iii) any actual or alleged act, error or omission in any way connected to Pollutants. AIG I CyberEdge® Policy Wording 05-24 | Page 46 of 47 PRIOR CLAIMS AND CIRCUMSTANCES The Insurer shall not be liable for Loss, arising out of, based upon, or attributable to: (i) any circumstance or Insured Event that as of the inception date specified in the schedule may reasonably have been expected by a Company’s Responsible Officer to give rise to a Claim under this policy; or any circumstance or Insured Event of which notice has been given under any policy of which this policy is a renewal or replacement or which it may succeed in time; (ii) any pending or prior civil, criminal, administrative or regulatory proceeding, investigation, arbitration, mediation, other dispute resolution or adjudication of which a Company’s Responsible Officer had notice as of the Continuity Date, or alleging or deriving from the same or essentially the same facts alleged in such actions; or (iii) any Insured Event that would otherwise constitute a Single Insured Event with any Claim or other matter reported under any policy of which this policy is a renewal or a replacement or which it may succeed in time. SATELLITE FAILURE The Insurer shall not be liable for Loss, arising out of, based upon, or attributable to any satellite failure. MONETARY VALUE The Insurer shall not be liable for Loss consisting of the actual monetary value of cash or a monetary instrument (including Cryptocurrency) arising from: (i) the theft of such cash or monetary instrument (including Cryptocurrency) from an Insured; or (ii) the transfer or Loss of such cash or monetary instrument (including Cryptocurrency) from or to an Insured’s accounts or accounts under an Insured’s control, including customer accounts. Accounts includes deposit, credit, debit, prepaid and securities brokerage accounts. This Exclusion shall not apply to coverage Included under the Cyber Crime Coverage Section. SANCTIONS The Insurer shall not be deemed to provide cover and the Insurer shall not be liable to pay any Claim or provide any benefit hereunder to the extent that the provision of such cover, payment of such Claim or provision of such benefit would expose the Insurer, its parent company or its ultimate controlling entity to any sanction, prohibition or restriction under United Nations resolutions or the trade or economic sanctions, laws or regulations of the European Union, the United Kingdom or the United States of America. TAXES The Insurer shall not be liable for Loss arising out of, based upon, or attributable to, or consisting of, any taxes payable by a Company howsoever arising, other than any GST or equivalent taxes payable in connection with the provision of products or services covered under this Policy, including but not limited to IT Services, Legal Services, Reputation Protection Services, Notification Expenses, Credit Monitoring and ID Monitoring Services or Cyber Extortion Services. UNINSURABLE AND PROHIBITED LOSS The Insurer shall not be liable for Loss: (i) which is uninsurable under the law of this policy or the law of the jurisdiction where the Claim is first made or other Insured Event first occurs; or (ii) which the Insurer is prohibited from paying by law or regulation (or any successor organisation). aig.co.nz Contact: American International Group, Inc. (AIG) is a leading global insurance organisation. AIG member companies provide insurance solutions that help businesses and individuals in approximately 70 countries and jurisdictions protect their assets and manage risks. AIG common stock is listed on the New York Stock Exchange. AIG Insurance New Zealand Limited All products and services are written or provided by subsidiaries or affiliates of American International Group, Inc. Level 7, 21 Queen Street Coverage is subject to the insurance contract and actual policy language. Non-insurance products and services may be provided by independent third parties. P.O. Box 1745 Shortland Street AIG Insurance New Zealand Limited (company number 3195589 and FSP189804) is a licensed general insurer, having Auckland 1140 its registered office address at Level 7, 21 Queen Street, Auckland 1010, New Zealand. Phone: +64 9 355 3100 © AIG, Inc. All rights reserved. Email: nz.contactus@aig.com NZFLCYBPWBR202405 AIG I CyberEdge® Policy Wording 05-24 | Page 47 of 47