Neiman Marcus 2009 Annual Report Download - page 312

ARTICLE VI
CARDHOLDER INFORMATION
6.1 Customer Information.
(a) All sharing, use and disclosure of Cardholder Data and NMG Shopper Data under this Agreement shall be
subject to the provisions of this ARTICLE VI. The Parties acknowledge that the same or similar information may be contained in the
Cardholder Data, the NMG Shopper Data, and other data and that each such pool of data shall therefore be considered separate
information subject to the specific provisions applicable to that data hereunder.
(b) NMG and Bank shall each maintain an information security program that is designed to meet all
requirements of Applicable Law, including, at a minimum, maintenance of an information security program that is designed to:
(i) ensure the security and confidentiality of the Cardholder Data and the NMG Shopper Data; (ii) protect against any anticipated
threats or hazards to the security or integrity of the Cardholder Data and the NMG Shopper Data; (iii) protect against unauthorized
access to or use of the Cardholder Data and the NMG Shopper Data; and (iv) ensure the proper disposal of Cardholder Data and NMG
Shopper Data. Additionally, such security measures shall meet current industry standards and shall be at least as protective as those
used by each Party to protect its other confidential customer information. Each Party shall use the same degree of care in protecting
the Cardholder Data and the NMG Shopper Data against unauthorized disclosure as it accords to its own confidential customer
information, but in no event less than a reasonable standard of care. In particular, Bank shall treat NMG Shopper Data as if it were
"customer information" for purposes of the regulations above. In the event a Party becomes aware of any unauthorized use of or
access to Cardholder Data, such Party shall immediately notify the other Party and shall cooperate with such other Party, as it deems
necessary or as required by Applicable Law, (x) to assess the nature and scope of such incident, (y) to contain and control such
incident to prevent further unauthorized access to or use of Cardholder Data, and (z) to provide prompt notice to affected Cardholders
to the extent required by Applicable Law or otherwise with the approval of the Management Committee. In the event Bank becomes
aware of any unauthorized use of or access to NMG Shopper Data, Bank shall immediately notify the NMG Companies and shall
cooperate with them, as they deem necessary or as required by Applicable Law, (x) to assess the nature and scope of such incident,
(y) to contain and control such incident to prevent further unauthorized access to or use of NMG Shopper Data, and (z) to provide
prompt notice to affected NMG Shoppers to the extent required by Applicable Law or otherwise with the approval of the Management
Committee. The cost and expenses of any such notice shall be borne solely by the Party that experienced the unauthorized use of or
access to Cardholder Data or NMG Shopper Data.
(c) The NMG Companies shall, subject to Applicable Law, promptly provide to Bank a complete list of any
Persons who (i) after the Effective Date, have requested to be on the NMG Companies' "do not call" list and/or (ii) have requested to
be on "do not mail" lists (or other similar lists), and Bank shall promptly comply with such requests with respect to its solicitation of
NMG Credit Cards and Approved Ancillary Products. Bank shall, subject to Applicable Law, promptly provide to the NMG
Companies a complete list of any Cardholders
61