Neiman Marcus 2009 Annual Report Download - page 313

who (i) after the Effective Date, have requested to be on Bank's "do not call" list and/or (ii) have requested to be on "do not mail" lists
(or other similar lists) in connection with their Cardholder relationship with Bank and the NMG Companies shall promptly comply
with such requests with respect to its solicitations.
6.2 Cardholder Data.
(a) As among the Parties hereto, the Cardholder Data shall be the property of and exclusively owned by Bank.
(b) The Program Privacy Policy applicable to the Cardholder Data is attached as Schedule 6.2 hereto. Any
modifications to the Program Privacy Policy shall be approved by the Management Committee, provided that the Program Privacy
Policy shall comply with Applicable Law at all times.
(c) Bank shall not use, or permit to be used, the Cardholder Data, except as provided in this Section 6.2. Bank
may use the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy solely (i) for purposes of soliciting
or marketing (in each case, solely as directed by the NMG Companies or the Management Committee) or servicing customers listed in
the Cardholder Data for NMG Credit Cards, Approved Ancillary Products, and any other products and services approved by the
Management Committee, (ii) as otherwise necessary to carry out its obligations or exercise its rights hereunder, or (iii) as required by
Applicable Law. Bank has no rights to use the Cardholder Data for marketing purposes except as expressly provided herein.
(d) Bank shall not disclose, or permit to be disclosed, the Cardholder Data, except as provided in this
Section 6.2. Bank shall not, directly or indirectly, sell or otherwise transfer any right in or to the Cardholder Data other than to NMG
or any of its Affiliates. Bank may disclose the Cardholder Data in compliance with Applicable Law and the Program Privacy Policy
solely: (i) to its authorized subcontractors in connection with a permitted use of such Cardholder Data under
this Section 6.2, provided that each such authorized subcontractor agrees in a written agreement
satisfactory to NMG and Bank to maintain all such Cardholder Data as strictly confidential and not to use
or disclose such information to any Person other than Bank or an NMG Company, except as required by
Applicable Law or any Governmental Authority (after giving Bank and the NMG Companies prior notice
and an opportunity to defend against such disclosure); provided, further, that each such authorized
subcontractor maintains, and agrees in writing to maintain, an information security program that is
designed to meet all requirements of Applicable Law, including, at a minimum, maintenance of an
information security program that is designed to: (w) ensure the security and confidentiality of the
Cardholder Data; (x) protect against any anticipated threats or hazards to the security or integrity of the
Cardholder Data; (y) protect against unauthorized access to or use of the Cardholder Data; and (z) ensure
the
62