| 12.5.2 | It and its Affiliates will, and will cause its and their licensees subcontractors (or Sublicensees and Subcontractors, as applicable) to, comply with all Applicable Laws pertaining to Personal Information (the “Privacy Laws”) to which it is subject in connection with such Party’s and its Affiliate’s, licensees (or Sublicensee’s, as applicable) or subcontractors (or Subcontractor’s, as applicable) activities related to this Agreement. To the extent that such Party or its Affiliates, licensees (or Sublicensees, as applicable), or subcontractors (or Subcontractors, as applicable) access or come into possession of Personal Information in connection with activities related to this Agreement, such Party and its Affiliates agree, and will cause its and their licensees (or Sublicensees, as applicable) and subcontractors (or Subcontractors, as applicable), to comply with applicable Privacy Laws to which it may be subject as a result thereof. Any processing (including the collection, storage, use, transfer, provision, publication, and deletion) by such Party or its Affiliates, licensees (or Sublicensees, as applicable), or subcontractors (or Subcontractors, as applicable) of Personal Information obtained in connection with activities under this Agreement will be done solely for the purpose of performing such Party’s obligations or exercising such Party’s rights in connection with the Development of Licensed Products consistent with the terms of this Agreement, will be in accordance with notices provided to and consents obtained from the data subjects whose Personal Information is being processed, and will be in accordance with all applicable Privacy Laws. From and after the Effective Date, each Party and its Affiliates will take, and ensure that its licensees (or Sublicensees, as applicable) and subcontractors (or Subcontractors, as applicable) take, commercially reasonable and appropriate technical and organizational measures to protect Personal Information (including the results and any clinical data obtained in connection with any Clinical Trials conducted by or on behalf of such Party) in its possession against unauthorized access, accidental loss or damage, and unauthorized destruction. Such Party and its Affiliates will further maintain, and ensure that its licensees (or Sublicensees, as applicable) and subcontractors (or Subcontractors, as applicable) maintain, a commercially reasonable program for protecting against unauthorized access to or loss, misuse, alteration, destruction, damage or disclosure of Personal Information (including the results and any clinical data obtained in connection with Clinical Trials conducted by or on behalf of such Party) in its possession pursuant to its activities under this Agreement (“Data Breach”). In the event of a Data Breach, such Party will (i) promptly, and in any event so as to allow the other Party to comply with its obligations under Applicable Law, notify the other Party by phone and email after becoming aware of such Data Breach, and (ii) comply with the relevant requirements and procedures of the applicable Privacy Laws in resolving such Data Breach. With respect to all activities performed by such Party and its Affiliates under the Agreement, such Party and its Affiliates will use reasonable efforts to, and to ensure that its subcontractors (or Subcontractors, as applicable), implement multi-factor authentication and encryption promptly following the Effective Date. Prior to transferring any data, files, or results containing any Personal Information to the other Party its Affiliate, subcontractor (or Subcontractor, as applicable) or licensee (or Sublicensee, as applicable) hereunder, the Parties will agree upon the manner and format of such transfer and the transferring Party will provide any required notices to and obtain any necessary consents from Governmental Authorities and data subjects prior to a transfer. With respect to such transferred data, each Party will promptly notify the other Party by phone and email after receiving a data subject request from an individual whose Personal Information was transferred to the other Party or its Affiliate, subcontractor (or Subcontractor, as applicable) or licensee (or Sublicensee, as applicable), and will comply with, and inform its Affiliates, subcontractors (or Subcontractors, as applicable) or licensees (or Sublicensees, as applicable) of the need to comply with, the relevant requirements and procedures of the applicable Privacy Laws in responding to such data subject request. Each Party will have the right, upon reasonable advance notice and at a time agreed by the Parties, to audit the other Party’s and its Affiliates’ compliance with the requirements of this Section 12.5.2. To the extent permitted under Zai’s agreements with its Sublicensees or Subcontractors, Blueprint will have the right to audit the data privacy and information security measures implemented by Zai’s Sublicensees and Subcontractors performing activities under this Agreement. If such audit is not permitted under Zai’s one or more agreements with its Sublicensees or Subcontractors, Zai will use reasonable efforts to obtain the right to conduct such an audit of the data privacy and information security measures of any such Sublicensees and Subcontractors. |