Neiman Marcus 2008 Annual Report Download - page 590

Cardholder Data under this Section 6.2, provided that each such authorized subcontractor agrees in a written agreement satisfactory to
NMG and Bank to maintain all such Cardholder Data as strictly confidential and not to use or disclose such information to any Person
other than Bank or an NMG Company, except as required by Applicable Law or any Governmental Authority (after giving Bank and
the NMG Companies prior notice and an opportunity to defend against such disclosure); provided, further, that each such authorized
subcontractor maintains, and agrees in writing to maintain, an information security program that is designed to meet all requirements
of Applicable Law, including, at a minimum, maintenance of an information security program that is designed to: (w) ensure the
security and confidentiality of the Cardholder Data; (x) protect against any anticipated threats or hazards to the security or integrity of
the Cardholder Data; (y) protect against unauthorized access to or use of the Cardholder Data; and (z) ensure the proper disposal of
Cardholder Data; and provided, further, that each such authorized subcontractor agrees to notify promptly Bank and the NMG
Companies of any unauthorized disclosure, use, or disposal of, or access to, Cardholder Data and to cooperate with Bank and the
NMG Companies in any investigation thereof and remedial action with respect thereto;
(ii) to its Affiliates, and its and such Affiliates' employees, attorneys and accountants with a need to know such
Cardholder Data in connection with a permitted use of such Cardholder Data under this Section 6.2; provided that (A) any such Person
is bound by terms substantially similar to this Section 6.2 as a condition of employment or of access to Cardholder Data or by
professional obligations imposing comparable terms; and (B) Bank shall be responsible for the compliance by each such Person with
the terms of this Section 6.2;
(iii) to any Governmental Authority with authority over Bank (A) in connection with an examination of Bank; or
(B) pursuant to a specific requirement to provide such Cardholder Data by such Governmental Authority or pursuant to compulsory
legal process; provided that Bank seeks the full protection of confidential treatment for any disclosed Cardholder Data to the extent
available under Applicable Law governing such disclosure, and with respect to clause (B), to the extent permitted by Applicable Law,
Bank (1) provides at least ten (10) Business Days' prior notice of such proposed disclosure to NMG if reasonably possible under the
circumstances, and (2) seeks to redact the Cardholder Data to the fullest extent possible under Applicable Law governing such
disclosure; or
(iv) to the extent permitted in the Risk Management Policies and Operating Procedures, to any consumer reporting agency
in accordance with the federal Fair Credit Reporting Act.
(e) To the extent Bank has access to the following information in accordance with the provisions of this Agreement and subject
to Applicable Law and the Program Privacy Policy, Bank shall transmit to the NMG Companies at such times as may be requested by
NMG and in formats agreed to by the Parties in advance from time to time:
(i) for any customer who has applied for an NMG Credit Card, regardless of the marketing channel of such application:
(A) the customer's name, address, email address, telephone number, social security number and all other information supplied on the
application or prescreened response submitted by the customer; (B) an indication of whether or not the customer has been approved
for an NMG Credit Card; and (C) if the customer has been approved for an NMG Credit Card or Non-Card Payment Plan, the NMG
Credit Card or Non-Card Payment Plan issued (or to be issued) to such customer;
36