> _Markdown transcription of Dual New Zealand Dual NZ Cyber policy wording, effective 2023-11-01. Source: https://nz.dualinsurance.com/hubfs/DUAL%20ANZ/DUAL%20New%20Zealand/NZ%20policy%20wording/DUAL-NZ-Cyber-Insurance-Wording.pdf_ --- DUAL Cyber Cyber Insurance 1 DUAL New Zealand Cyber Insurance Policy 11.23 DUAL New Zealand Cyber Insurance Policy Wording Contents Section 1: Preamble 5 Section 2: Insuring Clauses 5 Section 3: Automatic Extensions 5 Section 4: Optional Extensions 9 Section 5: Exclusions 10 Section 6: Definitions 13 Section 7: Claim Conditions 20 Section 8: General Conditions 22 2 DUAL New Zealand Cyber Insurance Policy 11.23 Important Notices We understand that this information is often sensitive, and we shall treat it with the utmost care. Our Privacy Policy contains information You should read the entire policy carefully, including all definitions and, about how you can access the information we hold about you, ask us in particular, the exclusions to ensure that it meets your requirements. to correct, or make a privacy related complaint. You can obtain a copy We recommend that you consult an insurance agent or broker to from our Privacy Officer by Telephone: +64 9973 0190 ensure a clear understanding of your rights and obligations under the policy. Email: privacy@dualnewzealand.co.nz Address: Level 6, 5 High Street, Auckland 1010 New Zealand About New Zealand Pty Ltd or by visiting our website (dualinsurance.com) DUAL New Zealand Limited (We/ Us/Our) is a Coverholder for certain Underwriters at Lloyd’s of London. DUAL has the authority to bind this By providing us with your personal information, you consent to its policy on behalf of Underwriters. collection and use as outlined above and in our Privacy Policy. Claims Made and Notified and Covered Events Complaints and Disputes Discovered Policy We view seriously any complaint made about our products or services This is partly a claims made and notified policy and partly a discovery and will deal with it promptly and fairly. policy. We shall only cover you for: Any enquiry or complaint relating to this policy should be referred to • claims made against you during the insurance period and us in the first instance by email to our office at: notified to us as soon as practicable during the insurance period; complaints@dualnewzealand.co.nz or If this does not resolve the matter or you are not satisfied with the way • covered events first discovered and notified to us as soon as a complaint has been dealt with, you can write to: practicable during the insurance period. Lloyd’s General Representative in New Zealand If your policy does not have a continuity of cover provision or provide c/o Hazelton Law retrospective cover then your policy may not provide insurance cover in relation to events that occurred before the Level 29 Plimmer Towers policy was entered into. 2-6 Gilmer Terrace Wellington Your Duty of Disclosure New Zealand Before you enter into a contract of insurance with an insurer, you have a duty to disclose to the insurer every matter that you know, or could Telephone +64 4 472 7582 reasonably be expected to know about yourself and others to be Facsimile +64 4 472 7571 insured, is relevant to the insurer’s decision whether to accept the risk If you are not satisfied with the final decision, you may wish to contact of the insurance and, if so, upon what terms. the Insurance and Financial Services Ombudsman Scheme (IFSO). You also have this duty every time your insurance renews and when The IFSO is a free independent external disputes resolution service you make any changes to it. If you or anyone acting on your behalf provided to customers to review and resolve complaints where we breaches this duty, we may treat this policy as being of no effect and have been unable to satisfy your concerns. to have never existed. If your non-disclosure is fraudulent, the Insurer You can contact the IFSO as follows: may also have the option of avoiding the contract in its entirety. The Insurance and Financial Services Ombudsman Scheme Privacy Statement PO BOX 10-845 We are committed to compliance with “Privacy Act 2020 (NZ)” (“the Wellington 6143 Privacy Act.”) We use your personal information to assess the risk of and provide insurance, assess and manage claims, to perform T: 0800 888 202 or +64 (09) 499 7612 administrative functions and to comply with regulatory requirements. E: info@ifso.nz We may also use your contact details to send you information and W: www.iombudsman.org.nz offers about products and services that we believe will be of interest to you. The Fair Insurance Code If you do not consent to provide us with the information which we Lloyd’s is a member of the Insurance Council of New Zealand, and request, we may not be able to provide insurance or assess a claim. If is committed to comply with the Council’s Fair Insurance Code. The you provide us with information about someone else, you must obtain purpose of the Code is to raise standards of practice and service in their consent to do so. the general insurance industry For further information on the Code, We provide your information to the insurer we represent when we please visit www.icnz.org.nz/individuals/about-the-code/ issue and administer your insurance. When providing a quotation or Notification of Claims insurance terms, we will tell you if the insurer is overseas and if so, In the event of a claim arising under this Insurance, immediate notice where they are. We are part of the Howden Group and may provide should be given to: your information to UK Based Group entities who provide us with business support services. We may also provide your information to Cyber Incident Management Team (CIMT) your broker and our contracted third party service providers (e.g. +64 483 10243 claims management companies) but will take all reasonable steps to Or at cyber.incident@canopius.com ensure that they comply with the Privacy Act. 3 DUAL New Zealand Cyber Insurance Policy 11.23 Canopius Suite 25.04 Level 25, 52 Martin Place Sydney NSW 2000, Australia Please refer to the Claims Conditions section of this policy for further details regarding the notification of claims or loss subject to this Insurance. Service of Suit Any summons, notice or process to be served upon us for the purpose of instituting any legal proceedings against us in connection with this Policy must be served upon: The Claims Manager DUAL New Zealand Limited Level 6, 5 High Street Auckland 1010 claims@dualnewzealand.co.nz who has authority to accept service and to enter an appearance on underwriters’ behalf, and who is directed at the request of the insured (or reinsured) to give a written undertaking to the insured (or reinsured) that they will enter an appearance on underwriters’ behalf. If a suit is instituted against any one of the underwriters, all underwriters hereon will abide by the final decision of such court or any competent appellate court. 4 DUAL New Zealand Cyber Insurance Policy 11.23 Section 1: Preamble We will provide the cover described in this policy, subject to its terms and conditions, for the insurance period. The cover under this policy commences upon the payment of the premium unless otherwise agreed in writing. Except as otherwise provided herein, this policy only covers: a. covered events first discovered and reported to us during the insurance period; and b. claims first made or commenced against an insured and reported to us during the insurance period, resulting from covered events which first occurred after the retroactive date. Section 2: Insuring Clauses 2.1 Response Costs We agree to pay to or on behalf of an insured all reasonable response costs necessarily incurred by the insured resulting from a cyber event, data breach event or media liability event. 2.2 Liability We agree to pay to or on behalf of an insured all loss arising from any claim resulting from a cyber event, data breach event or media liability event. 2.3 Business Interruption - Loss and Mitigation Costs We agree to pay to or on behalf of an insured all business interruption loss that is a direct result of a system outage which is caused by a cyber event. Section 3: Automatic Extensions These Automatic Extensions to coverage apply automatically and are subject to the insuring clauses and all other terms and conditions of this policy. A sub-limit of indemnity may apply to an Automatic Extension. All applicable sub-limits are specified in the schedule. The sub-limit is the maximum amount payable by us under an Automatic Extension. A sub-limit is part of and not in addition to the indemnity limit. A deductible may apply to an Automatic Extension. All applicable deductibles are specified in the schedule. The deductible is inclusive of defence costs, unless otherwise specified in the schedule. 3.1 Advancement of Defence Costs We agree to pay for defence costs in respect of any claim covered by this policy as and when they are incurred prior to final resolution of the claim. The maximum amount of defence costs we will advance is the amount of any applicable sub-limit or the indemnity limit. Upon exhaustion of the applicable sub-limit or the indemnity limit our obligation to advance defence costs will cease. However, any defence costs that are paid will be repayable to us by the insured in the event and to the extent that it is subsequently determined that the insured was not entitled to the payment of the defence costs under this policy. 3.2 Business Interruption – Human or System Error We agree to pay to or on behalf of an insured business interruption loss incurred by the insured as a direct result of a system outage which first occurs during the insurance period and is caused by a system or human error. 5 DUAL New Zealand Cyber Insurance Policy 11.23 3.3 Business Interruption – Reputational Damage We agree to pay to or on behalf of an insured business interruption loss that is a direct result of the loss of current or future customers caused by damage to the insured’s reputation, from when a cyber event is first discovered until 30 days after the end of the system outage. 3.4 Botnetting and Phreaking Expenses We agree to pay to or on behalf of an insured the increased costs of utilities (including electricity, telephone call or usage charges, and bandwidth) resulting from botnetting or phreaking. 3.5 Continuous Cover Notwithstanding Exclusion 5.20 (Prior Known Facts) we agree to provide cover in respect of any claim otherwise covered by this policy made against the insured during the insurance period where the insured: a. first became aware, prior to the insurance period, that a claim might or could arise from facts or circumstances known to it; and b. had not notified us of such facts or circumstances prior to the insurance period, provided that: i. we were the cyber liability and privacy protection insurer of the policyholder when the insured first became aware of such facts or circumstances and have continued, without interruption, to be the policyholder’s cyber liability and privacy protection insurer until this policy came into effect; ii. there has not been any fraudulent non-disclosure or fraudulent misrepresentation by an insured in respect of such facts or circumstances; iii. if the fact or circumstance had been notified under the previous policy, the insured would have been entitled to indemnity under the previous policy; iv. if we had been notified of the facts or circumstances when the insured first became aware of such facts, the insured would have been indemnified under the policy in force at that time, however is now not entitled to be indemnified by that policy, and the insured would, but for Exclusion 5.20 (Prior Known Facts) otherwise be indemnified by this policy; v. we have the discretion to apply either the terms and conditions of the policy on foot when the insured first became aware of the facts and circumstances, including the indemnity limit and deductible, or the terms and conditions of this policy; and vi. the insured all agree only to make a claim under one cyber liability and privacy protection policy issued by us. For the purpose of this Automatic Extension only, the definition of we/us/our in clause 6.58 of this policy also includes the Underwriter(s) for which we were the agent on any previous policy issued by us as such underwriter’s agent to the insured. Subject to the terms of this Automatic Extension and the terms of this policy, the intention of this Automatic Extension is to provide continuous cover notwithstanding any change in the identity of the underwriters for which we presently act, or have previously acted, as agent. 3.6 Court Attendance Costs We agree to pay to or on behalf of an insured any reasonable attendance costs of any officer or employee of the insured who is legally compelled to, and does, attend court or any other proceeding as a witness or defendant in a claim or regulatory investigation covered by this policy, to an amount of $500 per day. 3.7 Cyber Extortion We agree to: a. pay to or on behalf of the insured all reasonable fees, costs and expenses necessarily incurred by the insured to engage an approved provider to provide advice and assistance on whether and how to respond to a cyber extortion demand; and 6 DUAL New Zealand Cyber Insurance Policy 11.23  b. indemnify the insured for all monies paid by the insured with our prior written consent and which payment is legally permitted in satisfaction of a cyber extortion demand. 3.8 Discovery Period An insured may give us written notice of any: a. covered event first discovered during the insurance period; or b. claim first made against an insured during the insurance period, during a discovery period immediately following the insurance period of: c. 60 days granted automatically with no additional premium payable, unless an insured has made any claims for indemnity against this policy during the insurance period; or d. 12 months, if the policyholder requests such period in writing within 30 days after the end of the insurance period and tenders an additional premium of 100% of the expiring annual premium, commencing immediately after the end of the insurance period, such premium is payable within 30 days of the receipt by us of such written request; or e. 36 months, if a transaction takes place and the policyholder requests such period in writing within 30 days following the end of the insurance period, on such terms and conditions, if any, and for such additional premium as we may reasonably require. This Automatic Extension is not available if this policy is: f. renewed or replaced with any similar or like cyber liability and privacy protection insurance; or g. cancelled or avoided. Any discovery period purchased under this Automatic Extension is non-cancellable and the premium paid for the discovery period is fully earned by us and is non-refundable. 3.9 Emergency Costs If our written consent cannot reasonably be obtained before defence costs are incurred by an insured, we will pay those defence costs if the insured obtains our consent within thirty (30) days of the date that the first of those defence costs were incurred. If we subsequently determine that there is no entitlement under this policy for any defence costs that we have paid under this Clause, the insured must repay those amounts to us immediately. 3.10 Enforceable Undertaking Expenses We agree to pay to or on behalf of the insured any enforceable undertaking expenses incurred by the insured as a direct result of a regulatory investigation commenced during the insurance period. 3.11 Identity Protection Costs We agree to pay to or on behalf of an insured all reasonable fees, costs and expenses incurred by the insured, with our prior written consent, to engage an approved provider to provide services to protect against identity theft or credit fraud, including monitoring services and identity theft insurance, to affected individuals for a period of twelve (12) months, or such longer period as required by applicable law, as a direct result of a data breach event. 3.12 Legal Representation Costs We agree to pay to or on behalf of an insured all reasonable fees, costs and expenses in addition to the Limit of Liability resulting from a Charge over the policy, incurred by the insured to engage an approved provider to provide legal advice and representation, as reasonably necessary to protect the insured’s interests (including to prepare for, respond to, and produce documents to a regulatory investigation) in relation to a cyber event, data breach event or media liability event. 7 DUAL New Zealand Cyber Insurance Policy 11.23 3.13 Newly Created or Acquired Subsidiary We agree to provide coverage to any subsidiary acquired or created by the policyholder during the insurance period for a period of up to sixty (60) days (but never beyond the expiry date of the insurance period) from the date of such acquisition or creation where the subsidiary acquired satisfies the following criteria: a. total gross assets which are less than 25% of the total gross assets of the policyholder; or b. gross annual turnover of less than 25% of the total gross annual turnover of the policyholder; and c. total gross annual turnover that is less than 10% of the total gross annual turnover of the policyholder in the United States of America or Canada. We will agree to provide further coverage beyond a period of 60 days (but never beyond the expiry date of the insurance period) provided that the subsidiary acquired has provided evidence to meet our minimum requirements in respect of cyber security practices. Where the provisions at a., b. or c. above have not been met by the subsidiary acquired or created, we may, at our discretion, agree to provide further coverage for that subsidiary if: a. the policyholder has notified us of the acquisition or creation of the subsidiary and has provided all information requested by us; and b. any terms imposed by us, including the charging of any additional premium considered appropriate, have been agreed by the policyholder. 3.14 Notification Costs We agree to pay to or on behalf of an insured all reasonable fees, costs and expenses necessarily incurred by the insured to engage an approved provider to: a. notify any government authority, affected individual or other person or entity of a cyber event, data breach event or media liability event; b. facilitate inbound communications from affected individuals or other persons or entities (including arranging for a call centre to receive telephone calls) in relation to a cyber event, data breach event or media liability event; and c. place any public notice about, or make any public announcement or disclosure about, or public apology for, a cyber event, data breach event or media liability event, whether or not such measures are required by law. 3.15 Payment Card Breach Event We agree to pay to or on behalf of an insured all fines, penalties and other amounts which the insured is legally obliged to pay to the insured’s acquiring bank or payment processor as a direct result of a payment card breach event. 3.16 Post-event Consulting Costs We agree to pay to or on behalf of an insured all reasonable fees, costs and expenses incurred by the insured following a cyber event, data breach event, or media liability event to engage an approved provider to: a. conduct an information security risk assessment; b. conduct an information security gap analysis; c. prepare information security policies and procedures; and/or d. conduct information security training for the insured’s employees, as reasonably necessary to mitigate the risk of a future cyber event, data breach event or media liability event. 8 DUAL New Zealand Cyber Insurance Policy 11.23 3.17 Public Relations Costs We agree to pay to or on behalf of an insured all reasonable fees, costs and expenses incurred by the insured to engage an approved provider to provide advice and support as reasonably necessary to protect, or mitigate any damage to, the insured’s reputation from a cyber event, data breach event or media liability event. 3.18 Restoration Costs We agree to pay to or on behalf of an insured all reasonable fees, costs and expenses necessarily incurred by the insured to engage an approved provider to restore, repair and/or replace data and software that have been lost, corrupted or damaged as a result of a cyber event or data breach event, including the cost of purchasing replacement licenses for software where necessary. 3.19 Hardware Repair or Replacement Costs In circumstances where we consider that it is the most appropriate and economical solution, we agree to pay to or on behalf of an insured all reasonable fees, costs and expenses necessarily incurred by the insured with our prior written consent (not to be unreasonably withheld) to engage an approved provider to repair and/or replace hardware that has been damaged as a direct result of a cyber event or data breach event. Section 4: Optional Extensions The Optional Extensions only apply if indicated in the schedule and are subject to the insuring clauses and all other policy terms and conditions. A sub-limit of indemnity may apply to an Optional Extension. All applicable sub-limits are specified in the schedule. The sub-limit is the maximum amount payable by us under an Optional Extension. A sub-limit is part of and not in addition to the indemnity limit. A deductible may apply to an Optional Extension. All applicable deductibles are specified in the schedule. The deductible is inclusive of defence costs, unless otherwise specified in the schedule. 4.1 Contingent Business Interruption We agree to pay to or on behalf of an insured all contingent business interruption loss that is a result of an interruption to an insured’s business operations directly arising from a system outage of an external system which is caused by a contingent business interruption event first discovered during the insurance period. 4.2 Social Engineering and Cyber Fraud We agree to pay to or on behalf of an insured all: a. business interruption loss (as defined in sub-clause c. of the business interruption loss definition for the purpose of this Optional Extension only) as a direct result of a cyber fraud event; b. direct financial loss sustained by the insured as a direct result of a cyber fraud event; c. loss and defence costs resulting from any claim arising from a cyber fraud event; and d. push-payment fraud expenses. Section 5: Exclusions We will not make any payment under this policy in respect of: 5.1 Anti-competitive Conduct any contravention of any competition or anti-trust law by an insured. 9 DUAL New Zealand Cyber Insurance Policy 11.23 5.2 Anti-spam Laws any contravention of any law prohibiting the sending of unsolicited electronic communications by an insured. 5.3 Associates any claim by, on behalf of, or for the benefit of: a. any insured; or b. any family member, unless the family member is acting without any prior direct or indirect solicitation or co-operation from the insured, c. irrespective of the capacity in which the claim is brought by the insured or the family member. 5.4 Assumed Liability any obligation assumed by an insured under any agreement. This Exclusion does not apply to: a. Automatic Extension 3.15 (Payment Card Breach Event); b. any liability which is, or would have been, implied by law in such agreement or would have arisen separately from it; or any obligation of confidentiality assumed by the insured under any agreement. 5.5 Betterment any betterment, upgrade or improvement to the insured’s systems which was not part of the insured’s systems immediately prior to a covered event. This Exclusion shall not apply to the extent that Automatic Extension 3.19 (Hardware Repair or Replacement Costs) applies. 5.6 Bodily Injury the death of, or bodily injury or illness to, any person. 5.7 Deliberate Acts any act or failure to act by the policyholder or any subsidiary in the course of its business: a. intended by the policyholder or subsidiary; or b. that a reasonable person in the circumstances of the policyholder or subsidiary would expect, to cause loss, injury or damage, even if the actual loss, injury or damage is of a different degree or type than intended or expected. 5.8 Discrimination and Harassment any actual or alleged: a. sexual, racial or other harassment; b. sexual molestation; or c. discrimination or victimisation on the basis of sex, race, disability, sexual orientation, religious belief, age, or any other kind. 5.9 Directors and Officers any actual or alleged breach by an insured of its duties as a director or secretary of a corporate body. 10 DUAL New Zealand Cyber Insurance Policy 11.23 5.10 Employment any actual or alleged: a. breach by an insured of its obligations as an employer or potential employer of any person; or b. harassment, bullying or discrimination by an insured against any person. 5.11 Failure of Infrastructure and Utilities Any failure, outage in or disruption of, internet services, telecommunications services, power, utility services or other services not under the direct operational control of an insured or service provider. For the purpose of this Exclusion, service provider does not include an internet service provider, telecommunications service provider or a utility service provider. 5.12 Failure to Renew Contracts with Service Providers any failure by an insured or service provider to renew its contracts with service providers or any disruption to an insured’s business arising from the suspension of services due to the acts or omissions of an insured. This includes (but is not limited to) the suspension or revocation of a domain name resulting from the insured’s failure to renew contracts with its domain name provider. 5.13 Fraud and Dishonesty a. any actual or alleged act or omission by an insured or any of its consultants, sub-contractors or agents which was reckless, fraudulent, dishonest, malicious or criminal; or b. any wilful breach of any statute, regulation, contract or duty by an insured or any of its consultants, sub- contractors or agents. This Exclusion will only apply where it is established by an admission of such insured, consultant, sub-contractor or agent or by a judgment, award, finding or other adjudication of a court, tribunal, commission, or arbitrator that such conduct did in fact occur. 5.14 Insolvency any bankruptcy, administration, liquidation or insolvency of an insured or any other person, including a service provider. 5.15 Intellectual Property a. any infringement or alleged infringement of any intellectual property right including copyright, patent, trade mark, design or circuit layout rights; b. any use by an insured or service provider of any software in breach of the licence terms agreed with or imposed by the owner of the software; or c. the decline in value of any intellectual property asset as a result of unauthorised access to or disclosure of that asset. This Exclusion will not apply to a loss resulting from any claim resulting from a media liability event. 5.16 Internal Costs any internal or overhead expenses (including wages, salary, overtime and benefits) of an insured or the cost of an insured’s time. This Exclusion will not apply to the calculation of business interruption loss. 5.17 Natural Disasters any fire, explosion, lightning strike, wind, water, rain, hail, flood, tsunami, earthquake, landslide, volcanic eruption, Act of God or other natural event however caused. 11 DUAL New Zealand Cyber Insurance Policy 11.23 5.18 Pollution and Radioactive Contamination any: a. asbestos or any actual or alleged asbestos related loss, injury or damage involving the use, presence, existence, detection, removal, elimination or avoidance of asbestos or exposure to asbestos; b. ionising radiation or contamination by radioactivity from a nuclear fuel or from any nuclear waste from the combustion of nuclear fuel; c. radioactive, toxic, explosive or other hazardous properties of any explosive nuclear assembly; d. actual, alleged or threatened discharge of pollutants; or e. electromagnetic field, electromagnetic radiation or electromagnetism. 5.19 Professional Indemnity any claim arising from or directly or indirectly attributable to any negligent act error or omission, or any breach of contract in the provision of any service or the supply of any products by the insured. 5.20 Prior Known Facts any claim arising from or directly or indirectly attributable to or in consequence of: a. actual or alleged facts or circumstances that an insured knew, or ought reasonably to have known prior to the insurance period, might or could give rise to a claim, notwithstanding that such facts are disputed by the insured; b. actual or alleged facts which could have been, or which can be notified under any previous insurance policy existing prior to the commencement of the insurance period; c. pending or prior litigation, or derived from the same or essentially the same facts as are or might be alleged in such pending or prior litigation, as at the commencement of the insurance period; or d. any fact or matter referred to in the proposal or notified under any previous like policy existing prior to the commencement of the insurance period. 5.21 Property Damage the loss or destruction of, or damage to, any tangible property, excluding data and software. This Exclusion does not apply to Automatic Extension 3.19 (Hardware Repair or Replacement). 5.22 Sanctions Limitation any claim or loss to the extent that such cover, payment, service, benefit and/or any business or activity of the insured would violate any applicable trade or economic sanctions or any law or any regulation worldwide. This provision overrides all other terms of this policy. 5.23 Securities any actual or alleged violation of any law, regulation or rule (whether statutory or common law) relating to the ownership, purchase, sale or offer of, or solicitation of an offer to purchase or sell, securities. 5.24 Trading Losses any trading losses or trading liabilities. 5.25 Tax any taxes incurred by an insured including any penalty tax, costs, interest or fees and expenses in connection with any tax liability. 12 DUAL New Zealand Cyber Insurance Policy 11.23 5.26 War and Terrorism any: a. consequence of war, invasion, acts of foreign enemies, military hostilities (whether war be declared or not), civil war, rebellion, revolution, or insurrection; b. act of terrorism including but not limited to: i. the use or threat of force, violence; and/or ii. harm or damage to life or to property (or the threat of such harm or damage) including, but not limited to, nuclear radiation and/or contamination by chemical and/or biological agents, by any person(s) or group(s) of persons, committed for political, religious, ideological or similar purposes, express or otherwise, and/or to put the public or any section of the public in fear; or c. any action taken in controlling, preventing, suppressing or in any way relating to, a. or b. above. This Exclusion shall not apply to cyber terrorism. 5.27 Wear and Tear any defects in, ordinary wear and tear in relation to, or faulty design or installation of, the hardware components of the insured’s systems or external systems. Section 6: Definitions In this policy: 6.1 Affected individual means a natural person whose data has been or is reasonably suspected to have been the subject of unauthorised access, disclosure or lost as the result of a data breach event. 6.2 Approved provider means a person engaged by an insured, with the prior written consent of us or the incident response manager, to provide services in response to a covered event or claim. 6.3 Botnetting means the unauthorised use of the insured’s systems to carry out an electronic attack on, or interfere with the operation or security of, a third party’s systems or generate unsolicited electronic messages. 6.4 Business interruption loss means: a. the income (net profit or loss before taxes) that the insured would have generated directly from its business operations during the system outage period if the system outage had not occurred, less: i. the actual income (net profit or loss before taxes) that the insured did generate directly from its business operations during the system outage period; and ii. the actual income (net profit or loss before taxes) that the insured generated directly from its business operations after the system outage period that is attributable to business activity (including sales and the placement or processing of orders) that would otherwise have occurred during the system outage period, being delayed until after the system outage period; and iii. any cost savings achieved by the insured as a direct result of the reduction in business activity of the insured’s business operations during the system outage period; and b. any reasonable costs necessarily incurred by the insured to: i. maintain, as far as possible, the normal operation (including payroll) of the insured’s business during the system outage period; ii. mitigate the effects of and minimise the duration of the system outage; and iii. preserve evidence and substantiate a covered business interruption loss. 13 DUAL New Zealand Cyber Insurance Policy 11.23  c. For the purposes of Optional Extension 4.2 (Social Engineering and Cyber Fraud) only, business interruption loss means the income (net profit or loss before taxes) that the insured would have generated directly from its business operations but for the loss of current and future business opportunities, clients or customers resulting from a cyber fraud event, less i. the actual income (net profit or loss before taxes) that the insured did generate directly from its business operations during and until the remediation of the cyber fraud event including such income that is attributable to delayed business activity that would have occurred but for the cyber fraud event and did in fact occur after the remediation of the cyber fraud event; and ii. any cost savings achieved by the insured as a direct result of the reduction in income from its business operations during the remediation of the cyber fraud event. In calculating business interruption loss: d. consideration shall be given to the prior historical performance of an insured’s business operations before the system outage or cyber fraud event, and to the probable performance of the insured’s business operations if the system outage or cyber fraud event had not occurred; e. where the same or similar system outages or cyber fraud events affected both the insured and other businesses, the consideration of the probable performance of the insured’s business operations if the system outage or cyber fraud event had not occurred shall assume that neither the insured nor the other businesses were affected by the system outages or cyber fraud events, and shall not take into account any potential increase in business activity for the insured’s business operations if the system outages or cyber fraud events had affected other businesses but not the insured; f. the calculation of income under a. above and its sub-paragraphs will include any income generated from business operations during the relevant period, regardless of when that income is received or accounted for by the insured; and g. the calculation of costs under b. above will exclude any costs for which the insured is indemnified under any other clause of this policy. 6.5 Charge means any claim in respect of which the Insured has indemnity for: a. Legal Representation Costs under Automatic Extension 3.12; b. Defence Costs under this policy, but because such policy is subject to a charge under Section 9 of the Law Reform Act 1936 (New Zealand) Defence Costs and Legal Representation Costs cannot be indemnified under this policy. 6.6 Claim means any: a. written demand or notice seeking compensation or other legal remedy; b. threat or commencement of civil, criminal, judicial or arbitral proceedings; or c. regulatory investigation, first commenced or made against an insured during the insurance period. 6.7 Contingent business interruption event means: a. a person electronically attacking, or interfering with the operation or security of any external systems; or b. malware infecting any external systems; which causes a system outage. 6.8 Contingent business interruption loss means business interruption loss incurred after the waiting period until: a. the end of the system outage; or b. the date on which the insured engages a substitute external supplier to provide the same products or services, plus the reasonable additional time for the insured’s business operations to normalise; however not exceeding the system outage period listed in the schedule. 14 DUAL New Zealand Cyber Insurance Policy 11.23 6.9 Covered amount means any amounts we agree to pay under this policy, including business interruption loss, loss, defence costs and response costs. Covered amounts also includes contingent business interruption loss, direct financial loss and push-payment fraud expenses, if the relevant Optional Extensions apply. 6.10 Covered event means a cyber event, data breach event, media liability event, or a system outage. Covered event also means a contingent business interruption event if Optional Extension 4.1 (Contingent Business Interruption) applies. 6.11 Cyber event means: a. a person obtaining unauthorised access to the insured’s systems; b. a person electronically attacking, or interfering with the operation or security of, the insured’s systems; c. malware infecting the insured’s systems; d. the transmission of malware from the insured’s systems to a third party’s systems; e. botnetting; f. phishing; or g. phreaking; and includes any suspected cyber event for which there exist credible grounds for a reasonable person to have cause for such suspicion. 6.12 Cyber extortion demand means a demand, made by a third party to an insured, for payment to terminate an existing cyber event or data breach event or to prevent or avoid a threatened cyber event or data breach event. 6.13 Cyber fraud event means: a. the theft or unauthorised transfer of money or financial assets from the insured’s bank account or corporate credit cards, or money or financial assets in the insured’s care, custody or control, by electronic means; b. the unauthorised charging of any amount to the insured’s corporate credit cards by electronic means; c. the theft or unauthorised transfer of cryptocurrency or digital assets from the insured’s systems; d. the amendment of electronic documentation stored on the insured’s systems to manipulate the insured to pay or transfer money or financial assets to an unintended third party; e. social engineering. 6.14 Cyber terrorism means the premeditated use of disruptive activities, or threat to use disruptive activities, against a computer system or network with the intention to cause harm, further social, ideological, religious, political or similar objectives, or to intimidate any person(s) in furtherance of such objectives. 6.15 Data means any data or information held by an insured, or held on behalf of an insured by a service provider, whether in electronic or non-electronic form. 6.16 Data breach event means: a. any person obtaining unauthorised access to any data; b. the unintentional or unauthorised disclosure of any data by the insured or a service provider to any person who is not authorised by the insured to access or obtain it; c. the theft of any data from the insured or a service provider; d. the loss of any data by the insured or a service provider; e. the breach of any data protection law by the insured or any person for whom the insured is legally responsible; 15 DUAL New Zealand Cyber Insurance Policy 11.23  f. a payment card breach event; or g. the breach of any obligation of confidentiality to which the insured is subject by the insured or any person for whom the insured is legally responsible, and includes a suspected data breach event for which there exist credible grounds for a reasonable person to have cause for such suspicion. 6.17 Data protection law means any legislation which governs the processing of data or information about natural persons (including the Privacy Act 2020 (NZ) and the European Union General Data Protection Regulation 2016/679) which applies to an insured. 6.18 Deductible means the amount stated in the schedule. 6.19 Defence costs means reasonable fees, costs and expenses (including disbursements) necessarily incurred by an insured to engage an approved provider to prepare for, defend, settle or appeal a claim, including to obtain legal advice and representation and to prepare evidence. 6.20 Direct financial loss means financial loss suffered by the insured by loss of money, financial assets, cryptocurrency or digital assets owned by or belonging to the insured or in their care, custody or control, caused by a cyber fraud event provided such loss is not recoverable from any financial institution or any other source. 6.21 Discovered means when an officer first becomes aware of facts which would cause a reasonable person to believe that a covered event has or is likely to have occurred, although the exact detail of the covered event may not then be known. 6.22 Discovery period means the period of time specified in Automatic Extension 3.8 (Discovery Period) during which time written notice may be given to us of a covered event which is first discovered or a claim which is first made against an insured prior to the end of the insurance period or prior to a transaction. 6.23 Enforceable undertaking expenses means: a. the reasonable and necessary costs of implementing systems, processes and procedures for improved compliance and risk management (including staff training); b. legal fees, costs and expenses; and/or c. a charitable donation of a monetary sum made to a not-for-profit organisation, as a direct result of a condition of an enforceable undertaking given by an insured and accepted by a governmental, regulatory or law enforcement body as a result of a regulatory investigation, provided always that the insured obtains our prior written consent, which will not be unreasonably withheld, to incur such expenses. The onus of establishing that such expenses are the direct result of a condition of an enforceable undertaking is to be borne by the insured. 6.24 External supplier means a third party listed in the schedule that is party to a contract or agreement with the policyholder for the provision of products or services. 6.25 External systems means any computer system or computer network operated by an external supplier. 6.26 Family member means an insured’s: a. legal or de facto spouse, domestic partner or companion; b. parent and the parent of the person in paragraph a. above; c. children and the children of the people in paragraphs a. and b. above; and d. siblings. 6.27 Incident response manager means the person specified as such in Claims Condition 7.1 (Notification) or any replacement that we subsequently notify in writing to you. 6.28 Indemnity limit means the amounts specified in the schedule. 6.29 Insurance period means the period specified in the schedule. 16 DUAL New Zealand Cyber Insurance Policy 11.23 6.30 Insured means the policyholder, any subsidiary and any insured person. 6.31 Insured person means any current, future or former principal, partner, employee, director or secretary of the policyholder or any subsidiary, and includes a sole trader. 6.32 Insured’s systems means: a. any computer system or computer network operated by an insured in the course of the insured’s business; or b. any computer system or computer network operated on behalf of an insured by a service provider for use by the insured’s business, and includes any infrastructure, platform, application or data service. 6.33 Loss means judgments, settlements, awards, and costs, including damages, consumer redress funds, fines, penalties and punitive and exemplary damages resulting from a claim. Notwithstanding the above, loss shall not include any amount which is uninsurable according to the law applicable to the claim. Enforceability of this paragraph shall be governed by such applicable law that most favours coverage. 6.34 Malware means any software designed to: a. attack, interfere with, disrupt or damage any computer system or network; b. erase, encrypt, exfiltrate, steal or corrupt data; c. circumvent any network security product or service; d. surreptitiously monitor the operation or use of any computer system or network; or e. surreptitiously use any computer system or network for any purpose. 6.35 Material means media content, advertising and written, printed, video, electronic, digital, or digitalised content, of: a. broadcasts, including, broadcasts via television, motion picture, cable, satellite television, radio, wireless devices or the internet; b. publications, including publications via newspaper, newsletter, magazine, book and other literary, monograph, brochure, directory, music, directories, electronic, screen play, film script, playwright and video publications including the researching, preparation, serialisation, exhibition or distribution of publishing materials; or c. advertising, graphic design, design of logos or trademarks, purchasing of advertising time and space, market research, public relations, direct mailing, design of games, competitions or special offers. 6.36 Media liability event means an actual or alleged act, error, misstatement, misleading statement or omission by an insured in connection with the collection, creation, release, printing, broadcast or distribution of material that results in: a. an infringement of copyright, title, slogan, trade-mark, trade name, or domain name; b. plagiarism, piracy or misappropriation or theft of ideas; c. any false light, public disclosure of private facts, defamation committed without malice by reason of words written, spoken or broadcasted, including emotional distress or mental anguish in connection with such conduct; or d. an intrusion, invasion of privacy, wrongful entry or eviction, trespassing or eavesdropping. 6.37 Officer means any past, present or future: a. partner, principal, director or secretary of the policyholder or a subsidiary; or b. person who makes or participates in making decisions that affect the whole, or a substantial part, of the business of the policyholder or a subsidiary. 17 DUAL New Zealand Cyber Insurance Policy 11.23 6.38 Payment card breach event means: a the unintentional or unauthorised disclosure of payment card data stored or processed by an insured or service provider on behalf of the insured; or b. the breach of any Payment Card Industry Digital Security Standard by an insured or any person for whom an insured is legally responsible, and includes a suspected payment card breach event. 6.39 Policy means this policy wording, the schedule, the proposal and any endorsement attaching to and forming part of this policy either at commencement or during the insurance period. 6.40 Policyholder means the entity named in the schedule. 6.41 Phishing means fraudulent electronic communications or websites designed to impersonate the insured or any of the insured’s products or services for the purpose of soliciting information about the insured’s clients or customers. 6.42 Phreaking means any fraudulent, dishonest, unauthorised or malicious use of the insured’s telephone system which results in charges or bandwidth costs which the insured is legally liable to pay. 6.43 Proposal means the proposal form, submission and all other supporting documentation and attachments provided to us in the application for this policy. 6.44 Push-payment fraud expenses means an insured’s cost of reimbursing a client or customer of the insured or another person who is contractually required to debit, pay, deliver or transfer money or securities to the insured (a “client”) for their financial loss resulting directly from the impersonation of an insured, by a third party that has first gained unauthorised access to the insured’s systems, to manipulate the client to issue an instruction to a financial institution to debit, pay, deliver or transfer money or securities from an account maintained by the client to another account not maintained by the insured. 6.45 Regulatory investigation means an official investigation, examination, inquiry, hearing, legal action or similar proceeding initiated by a governmental, regulatory or law enforcement body against an insured. 6.46 Response costs means reasonable fees, costs and expenses incurred by an insured to engage an approved provider to take reasonable and necessary steps to: a. manage the response to a cyber event, data breach event or media liability event (excluding those costs which are borne by us under Condition 7.3 (Incident Response Manager Fees in Addition) of this policy); b. investigate the cause, scope and extent of any cyber event, data breach event or media liability event; c. contain and minimise the scope and extent of a cyber event, data breach event or media liability event; d. cease any unauthorised access to, electronic attack on or interference with the insured’s systems and remove any malware from the insured’s systems; e. prevent, minimise or mitigate the impact of a cyber event, data breach event or media liability event; and f. preserve evidence of criminal or malicious wrongdoing in relation to a cyber event, data breach event or media liability event. 6.47 Retroactive date means the date specified in the schedule but no earlier than the commencement of the insured’s business. 6.48 Schedule means the schedule attached to this policy or any schedule subsequently substituted for it during the insurance period and duly signed, stamped and dated by our authorised representative. 6.49 Service provider means a third party which provides an insured with computing services, including hosted computer services or cloud services, accessed through the internet or a dedicated network. 6.50 Social engineering means the impersonation of: a. an insured person; 18 DUAL New Zealand Cyber Insurance Policy 11.23  b. client or customer of the insured; or c. a person or entity with which the insured has a written contract for the sale or purchase of goods or services, by a third party which causes an insured person to issue an instruction to a financial institution to debit, pay, deliver or transfer money, financial assets, cryptocurrency, digital or tangible assets from an account maintained by the insured to that third person or other person or entity. Social engineering includes a third party acting in collusion with an insured person provided that the insured person issuing the instruction was not a party to the collusion. 6.51 Subsidiary means any entity which by virtue of any applicable legislation or law is deemed to be a subsidiary of the policyholder or in which the policyholder owns or controls, directly or indirectly 50% or more of the issued voting shares of such entity. 6.52 System or human error means: a. a negligent or accidental act or omission of an insured in relation to the insured’s systems; or b. a failure or error in the software or hardware of the insured’s systems. 6.53 System outage means the unavailability, interruption or degradation of: a. the insured’s systems; or b. where Optional Extension 4.1 (Contingent Business Interruption) applies, for the purposes of that Optional Extension only, external systems; which renders the insured incapable of supporting normal business functions. A system outage will commence when it is first discovered, and end when the insured’s systems (or external systems, if applicable) are restored to the same or equivalent availability, functionality and performance that existed immediately prior to the system outage. 6.54 System outage period means the period: a. commencing at the end of the waiting period; and b. ending when the system outage ends, but not exceeding the maximum system outage period listed in the schedule, calculated from the date on which the system outage first occurred. The system outage period will not be limited by the expiration of the insurance period. 6.55 Transaction means any one of the following events: a. the policyholder consolidates with or merges into or sells all or a controlling interest in its assets to any other person or entity or group of persons and/or entities acting in concert; b. any person or entity, whether individually or together with any other person or persons, entity or entities becomes entitled to exercise more than 50% of the rights to vote at general meetings of the policyholder or control the appointment of directors who are able to exercise a majority of votes at board meetings of the policyholder; c. the insolvency of the policyholder; or d. the appointment of an administrator, liquidator, receiver, receiver and manager, and manager or court appointed manager to the policyholder. 6.56 Unauthorised, in relation to an act, means that the person doing the act was not authorised to do the act by an insured, and includes an employee of an insured acting beyond their authority without the knowledge and consent of a director, C-level executive, in-house lawyer, partner or risk manager of the insured. 6.57 Waiting period means the number of hours or days stated in the schedule from the commencement of a system outage. 19 DUAL New Zealand Cyber Insurance Policy 11.23 6.58 We/us/our means DUAL New Zealand Limited as agent of the Underwriters referred to in the schedule. Section 7: Claim Conditions These Claims Conditions apply to all Sections of this policy: 7.1 Notification For the purposes of this policy, Cyber Incident Management Team (CIMT) is appointed as our incident response manager. An insured must notify a covered event or claim to the incident response manager as soon as reasonably practicable after the insured becomes aware of such covered event or claim. The insured shall provide such information and documentation relating to a covered event or claim as we or the incident response manager may reasonably require. A notification of a covered event or claim made by the insured to the incident response manager shall be deemed to be a notification of a covered event or claim to us. In the event of a claim or covered event, please contact CIMT in the first instance: +64 483 10243 Or at cyber.incident@canopius.com Suite 25.04 Level 25, 52 Martin Place Sydney NSW 2000, Australia 7.2 Notification of Direct Financial Loss An insured shall, as a condition precedent to our obligations under this policy, give written notice to us or the incident response manager of any direct financial loss as soon as practicable within the insurance period, or within the discovery period if applicable, but in any event not later than sixty (60) days after any direct financial loss is first discovered. 7.3 Incident Response Manager Fees in Addition The costs of the incident response manager to: a. answer an insured’s call or email and obtain initial details of a potential covered event or claim; b. provide the insured with initial advice on the appropriate response to the potential covered event; c. identify appropriate approved providers to respond to the potential covered event and engage those approved providers on behalf of the insured; and d. manage the response to the potential covered event, after a potential covered event or claim is notified to the incident response manager will be borne by us and will not erode the indemnity limit. 7.4 Approved Providers An insured must only engage approved providers to provide services in response to a covered event or claim. Notwithstanding any other term of this policy, we will not be liable for any response costs, defence costs or costs incurred under Automatic Extensions 3.10, 3.11, 3.12, 3.14, 3.16, 3.17, 3.18 or 3.19 for services provided by any third party who is not an approved provider. 20 DUAL New Zealand Cyber Insurance Policy 11.23 7.5 Co-operation a. An insured must, at the insured’s own cost, frankly and honestly provide us with all information, documentation, evidence and assistance reasonably required by us, the incident response manager or any approved provider. b. An insured must, at its own cost, do all things reasonably practicable to minimise any covered amounts, including the insured’s liability in respect of any claim. c. Each insured must provide us, at their own cost, with all information, assistance and co-operation which we reasonably require, and in the event of a claim or potential claim, each insured agrees that they will not do anything that could potentially prejudice our position or our potential or actual rights of recovery. d. No insured may settle any claim or incur any defence costs or assume any contractual obligation or admit any liability with respect to any claim without our written consent. 7.6 Allocation Our liability under this policy is limited to the proportion of covered amounts, which is a fair and equitable allocation as between: a. covered and uncovered parties; and/or b. covered and uncovered matters, having regard to the relative legal and financial exposures attributed to the covered and uncovered matters and/ or parties. Only covered amounts incurred by covered parties in relation to covered matters will be covered by this policy, and is subject always to the terms and conditions of this policy. We will use our best endeavours to agree upon a fair and equitable allocation of the proportion covered under this policy, having regard to the relative legal and financial exposures attributable to covered and uncovered matters and/or parties. If an allocation cannot be agreed then it will be determined by a suitably qualified Senior Counsel to be mutually agreed upon or, in default of agreement, to be nominated by the then President of the Bar Association of the jurisdiction in which this policy was underwritten. The Senior Counsel will make a determination as an expert based on the relative legal and financial exposures attributable to covered and uncovered matters and/or parties. Submissions made to the Senior Counsel will be in writing. Pending Senior Counsel’s determination we will meet the covered amounts on an interim basis at the percentage at which we contend they should be fairly and equitably allocated. After the allocation has been determined or agreed, such allocation will be applied retrospectively. The parties agree to be bound by the Senior Counsel’s determination. The costs of any referral for determination to a Senior Counsel under this Clause will be borne by us. 7.7 Insured’s Right to Contest and our Discharge of Liabilities a. In the event that we recommend settlement of a claim and the insured: i. does not agree to the settlement of the claim; and ii. decides to contest the claim, our liability shall not exceed the amount for which the claim could have been settled, and defence costs incurred up to the date upon which the claim could have been settled. b. At any time, we may pay to the insured, or on the insured’s behalf, in respect of any claim, the indemnity limit, or any applicable sub-limit, (after deduction of any amount already paid) or any lesser amount for which a claim or claims may reasonably be settled. c. After we have paid such an amount, we will relinquish the conduct and control of such claim or claims and we will no longer be liable for the claim(s) (or future conduct of the claim(s)) except for defence costs incurred up until the time we agreed to pay. We will not pay any amount or defend any claim after our indemnity limit has been exhausted. 21 DUAL New Zealand Cyber Insurance Policy 11.23 7.8 Legal Representation and Settlement An insured will not admit liability, settle any claim, make any admission, offer any payment or assume any obligation in connection with any claim, incur any defence costs or other covered amounts, without our prior written consent, which will not be unreasonably withheld or delayed. We will not be liable for any settlement, defence costs or other form of loss, admission, offer, payment or assumed obligation to which we have not given our prior written consent. We will have the right and will be given the opportunity to associate with each insured and participate in the defence of any claim including the negotiation and settlement of a claim. With respect to any claim involving more than one insured, the insureds agree that we have the right to require such insureds to retain separate legal representation. 7.9 Order of Payments If the payment of covered amounts under this policy in the aggregate exceeds the remaining available indemnity limit, we will: a. first pay such covered amounts for which the policyholder does not indemnify an insured person; then b. to the extent of any remaining amount of the indemnity limit available after payment under paragraph a. above, pay such covered amounts for which coverage is provided under any other provision of this policy. We will otherwise pay covered amounts under this policy in the order in which such covered amounts are presented to us for payment. 7.10 System Maintenance and Backups An insured must, at the insured’s own cost: a. take reasonable measures to maintain the availability and security of the insured’s systems; b. take reasonable measures to maintain reasonably regular back-up copies of data; and c. require any service provider to do the things set out in paragraphs a. and b. above in relation to the insured’s systems that it operates. Section 8: General Conditions The following General Conditions apply to all Sections of this policy: 8.1 Subrogation and Recoveries Where we have paid any covered amount under this policy, we become entitled to assume any rights available to the insured against any party to the extent of our payment. On our request, the insured must assign all rights of recovery against any person or entity, but only to the extent that payment has been made under this policy. An insured must, at its own cost, assist us and provide information as we may reasonably require to exercise our rights of recovery and/or subrogation. This may include providing and signing statements and other documents and the giving of evidence. Where a recovery is made, the proceeds of such a recovery will be applied as follows: a. firstly, to the satisfaction of all costs incurred in effecting the recovery; b. secondly, to the insured for the covered amount in excess of the indemnity limit specified in the schedule which is also in excess of any excess insurance purchased over this policy; c. thirdly, to us and any excess insurers amounts paid under this policy and such excess policies; d. finally, to the insured for the amount paid in respect of the deductible. 22 DUAL New Zealand Cyber Insurance Policy 11.23 8.2 Goods and Services Tax Where upon receiving any indemnity payment under this policy, the insured is liable to pay tax under Section 5(13) of the Goods and Services Act 1985 (or any statutory amendment or re-enactment of the Section or Act) and/or under the equivalent legislation in any other jurisdiction to which this cover applies, we will indemnify the insured for the amount of that tax. The indemnity under this clause is payable by us in addition to the indemnity limit. 8.3 Alteration to Risk An insured must notify us in writing as soon as practicable of any material alteration to the risk during the insurance period including: a. the insured going into voluntary bankruptcy, receivership, administration or liquidation; or b. the insured failing to pay debts as and when those debts become due; or c. the insured breaching any other obligation giving rise to the appointment of a receiver or the commencement of bankruptcy or winding up proceedings; or d. any material change in the nature of the insured’s business. We may not cover an insured for any claim if the insured does not notify us in writing as soon as practicable of any material alteration to risk. If during the insurance period, a transaction occurs, then the cover under this policy will only apply to any covered event first discovered or claim first made against the insured prior to the effective date of the transaction. If, during the insurance period, the policyholder decides to make a public offering of its securities in any jurisdiction, the policyholder must provide us with any prospectus or offering statement for our review and assessment. We will be entitled to amend the terms and conditions of this policy and/or charge an additional premium reflecting any potential increase in exposure, which we deem reasonable. 8.4 Assignment An insured must not assign this policy or any rights under this policy without our prior written consent by way of endorsement to this policy. 8.5 Cancellation a. The insured may cancel the policy at any time by notifying us in writing. b. The insured may cancel the policy at any time by sending 30 days notice in writing to the insured named in the schedule of the date from which cancellation is to take effect. Such notice may be delivered personally, posted, emailed or faxed to the insured named in the schedule or their representative last notified to us. c. On cancellation of this policy, we will retain the proportion of the premium calculated pro-rata as at the date of the cancellation plus fifteen percent (15%) of that amount. 8.6 Several Liability of Underwriters The obligations of our subscribing underwriters, where there is more than one underwriter referred to in the schedule subscribing to this policy, are several and not joint and are limited solely to the extent of their individual subscriptions. No subscribing underwriter is responsible for the subscription of any co-subscribing underwriter who, for any reason, does not satisfy all or part of its obligations. 8.7 Confidentiality An insured must not disclose, either personally or through any person or entity acting on the insured’s behalf or at the insured’s direction, to any third party: 23 DUAL New Zealand Cyber Insurance Policy 11.23  a. the existence of this policy; b. the nature of the indemnity provided; c. the indemnity limit; or d. the amount of premium paid. However, the insured may disclose the above matters to the extent that: i. the insured is required to do so by law; ii. we consent to the disclosure in writing; iii. it is necessary to disclose to the insured’s professional advisers including accountants, auditors, legal advisers and insurance brokers; or vi. we provide a Certificate of Currency which can be provided to third parties. 8.8 Territorial Scope Unless otherwise stated in the schedule and subject to General Condition 8.9 (Jurisdictional Limitation), cover provided under this policy extends to the conduct of an insured anywhere in the world. 8.9 Jurisdictional Limitation Unless otherwise stated in the schedule, cover provided under this policy extends to loss with respect to a claim brought and maintained anywhere in the world. 8.10 Governing Law This policy is governed by the laws of New Zealand where this policy was issued. Any dispute relating to policy interpretation will be submitted to the exclusive jurisdiction of the Courts of New Zealand where this policy was issued. 8.11 Indemnity Limit a. Subject to any extension of coverage which states otherwise, our total liability under this policy in respect of any one covered event or claim, and in the aggregate for all covered events and all claims for all insureds, will not exceed the indemnity limit inclusive of all covered amounts. b. The schedule will indicate the indemnity limit applicable to this policy. If more than one policy has been purchased, the schedule will also indicate the aggregate indemnity limit for all policies which have been purchased by the policyholder. c. We will have no liability in excess of the sub-limits specified in the schedule in the aggregate for the applicable extension of cover, irrespective of the number of policy sections, which respond to a covered event or claim. In such circumstances, we will apply the higher of the sub-limits or indemnity limit available. d. For the purposes of determining the indemnity limit available for: i. each claim covered by this policy, all claims arising from the same covered event or related covered events, shall be regarded as one claim; and ii. each covered event covered by this policy, related covered events shall be regarded as one covered event. 8.12 Deductible a. Our liability under this policy for covered amounts will only apply to that part of each covered amount which is in excess of the deductible or waiting period, whichever applies, specified in the schedule. Such deductible or waiting period will be borne by the insured, except where otherwise provided. b. Unless otherwise expressed in the schedule, all deductibles are inclusive of all covered amounts to the amount of the deductible. 24 DUAL New Zealand Cyber Insurance Policy 11.23  c. Except as otherwise stated in this policy, costs and expenses incurred by us in determining whether we are liable to indemnify the insured under this policy will not erode the indemnity limit and will be met by us. d. For the purposes of determining the deductibles available for: i. each claim covered by this policy, all claims arising from the same covered event or related covered events, shall be regarded as one claim; and ii. each covered event covered by this policy, related covered events shall be regarded as one covered event. 8.13 Related Claims a. Where multiple policy claims directly or indirectly arise out of or are in any way connected with the same covered event or other originating cause, all of those policy claims will be deemed to be a single policy claim, reported at the date of the first such policy claim. b. Any claims or covered events which trigger more than one insuring clause under this policy will be deemed to be a single policy claim, and only one deductible shall apply. In respect of a business interruption loss, one waiting period and one deductible shall apply. Where two or more deductibles of differing values are applicable, the highest deductible shall apply. 8.14 Severability, Non-imputation and Non-avoidance No state of mind or knowledge possessed by any one insured person will be imputed to any other insured person for the purpose of determining whether any provision in this policy applies. However, any state of mind or knowledge possessed by any past or present chairman of the board, chief executive officer, chief operating officer or chief financial officer of the policyholder or any subsidiary will be imputed to the policyholder. We agree not to rescind or avoid this policy in whole or in part, for any reason. 8.15 Preservation of Right to Indemnity In the event and to the extent that the policyholder has not indemnified an insured person but is legally permitted or required to do so in respect of a covered event or claim, but for whatever reason, refuses to do so, then we will pay on behalf of the insured person any covered amounts within the deductible and the applicable deductible will be paid by the policyholder to us. 8.16 Other Insurance All claims payable under this policy will not be in excess of any other insurance indemnity or cover available to the insured in respect of that claim. If such other insurance is provided by us, or any other member company, associate or affiliate, and it covers a loss covered by this policy in respect of a claim or loss, the indemnity limit under that other policy in respect of that claim or loss shall be reduced by any amount paid by us (or member company, associate or affiliate) under this policy. This policy will not be subject to the terms of any other insurance, unless specifically agreed. 8.17 Currency Any reference to premium, limits, deductibles and covered amounts are expressed and are payable in New Zealand Dollars. Where any payment is to be made into an admitted foreign jurisdiction, such payment is to be made and denominated in New Zealand Dollars at the cash rate for the purchase of New Zealand Dollars set by the Reserve Bank of New Zealand as at 4.00pm on the date which the foreign payment becomes due. 8.18 Basis of Valuation With respect to any direct financial loss which is covered under this policy, we are not liable for more than: a. The actual market value of securities or money at the close of business on the day the direct financial loss was first discovered (determined by the value published in the New Zealand Stock Exchange and/or Reserve Bank of New Zealand, or the actual cost of replacing the securities or money, whichever is less; or 25 DUAL New Zealand Cyber Insurance Policy 11.23  b. The actual cash value of other tangible property (not referred to in a. above) at the close of business on the day the direct financial loss was first discovered, or the actual cost of replacing the property with property of like quality of value, whichever is less; or c. The cost of blank books, blank pages or other materials plus the cost of labour and computer time for the actual transcription or copying of data furnished by the insured in order to reproduce books of account and other records; or d. The cost of labour for the actual transcription or copying of electronic data furnished by the insured in order to reproduce such electronic data. 8.19 Interpretation Words and phrases appearing in bold text and where used in this policy, have the meaning defined in this policy. To the extent that there are any inconsistencies between this policy and this General Conditions Section, the terms and conditions contained in this policy will prevail. In this policy: a. the singular includes the plural; b. including means including without limitation; c. the headings are for descriptive purposes only; and if any portion of this policy is found to be invalid or unenforceable, the remainder will remain in full force and effect. Helping you do more New Zealand | +64 9 973 0190 dualinsurance.com DUAL New Zealand Limited | Registered in New Zealand under Company Number 3232892 26 DUAL New Zealand Cyber Insurance Policy 11.23