Neiman Marcus 2009 Annual Report Download - page 316

designed to meet all requirements of Applicable Law, including, at a minimum, maintenance of an
information security program that is designed to: (w) ensure the security and confidentiality of the
Cardholder Data; (x) protect against any anticipated threats or hazards to the security or integrity of the
Cardholder Data; (y) protect against unauthorized access to or use of the Cardholder Data; and (z) ensure
the proper disposal of Cardholder Data; and provided, further, that each such existing subcontractor and
Future Subcontractor agrees to notify promptly Bank and the NMG Companies of any unauthorized
disclosure, use, or disposal of, or access to, Cardholder Data and to cooperate with Bank and the NMG
Companies in any investigation thereof and remedial action with respect thereto;
(ii) to its Affiliates, and its and such Affiliates' employees, attorneys and accountants with a need to
know such Cardholder Data in connection with a permitted use of such Cardholder Data under this
Section 6.2; provided that (A) any such Person is bound by terms substantially similar to this Section 6.2 as
a condition of employment or of access to Cardholder Data or by professional obligations imposing
comparable terms; and (B) the NMG Companies shall be responsible for the compliance by each such
Person with the terms of this Section 6.2; or
(iii) to any Governmental Authority with authority over such NMG Company (A) in connection with
an examination of such NMG Company; or (B) pursuant to a specific requirement to provide such
Cardholder Data by such Governmental Authority or pursuant to compulsory legal process; provided that
such NMG Company seeks the full protection of confidential treatment for any disclosed Cardholder Data
to the extent available under Applicable Law governing such disclosure, and with respect to clause (B), to
the extent permitted by Applicable Law, such NMG Company (1) provides at least [***] prior notice of
such proposed disclosure to Bank if reasonably possible under the circumstances, and (2) seeks to redact
the Cardholder Data to the fullest extent possible under Applicable Law governing such disclosure.
(h) With respect to the sharing, use and disclosure of the Cardholder Data following the termination of this
Agreement: (i) the rights and obligations of the Parties under this Section 6.2 shall continue through the date on
which this Agreement ceases to be in effect (i.e., the date on which any expiration or termination of this
Agreement becomes effective);
(ii) if NMG exercises its rights under Section 17.2, Bank shall transfer its right, title and interest in
the Cardholder Data to NMG or its Nominated Purchaser as part of such transaction, and Bank's right to
use and disclose the Cardholder Data shall terminate upon the date on which this
65