(kk) The Company and its subsidiaries possess all certificates, authorizations and permits issued by the appropriate federal, state or foreign regulatory authorities necessary to conduct their respective businesses, and neither the Company nor any of its subsidiaries has received any notice of proceedings relating to the revocation or modification of any such certificate, authorization or permit which, individually or in the aggregate, if the subject of an unfavorable decision, ruling or finding, would have a Material Adverse Effect;
(ll) The Company has not sold, issued or distributed any shares of its common stock during the six-month period preceding the date of this Agreement, including any sales pursuant to Regulation D or S of the Act, other than shares issued pursuant to employee benefit plans, qualified stock option plans or other employee compensation plans or pursuant to outstanding options, rights or warrants;
(mm) From the time of initial confidential submission of a registration statement relating to the Shares with the Commission through the date of this Agreement, the Company has been and is an “emerging growth company” as defined in Section 2(a)(19) of the Act (an “Emerging Growth Company”);
(nn) Except as would not be reasonably expected to have a Material Adverse Effect, the Company’s and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications and databases and any other information technology systems owned, licensed, or otherwise used by the Company, and, to the knowledge of the Company, any such equipment or technology maintained or provided by any third parties to Company or its subsidiaries (collectively, “IT Systems”) are (A) adequate for, and operate and perform in all material respects as necessary for the uninterrupted operation of the business of the Company and its subsidiaries as currently conducted, and (B) free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware, harmful code, and other corruptants. The Company and its subsidiaries have implemented and maintained all commercially reasonable controls, policies, procedures and safeguards to maintain and protect its confidential, proprietary, and sensitive information and the privacy, confidentiality, integrity, availability, continuous operation, redundancy and security of all IT Systems and data (including all information that relates to an identified or identifiable individual or is regulated as “personal information”, “personally identifiable information”, “personal data”, or any similar information governed by laws relating to privacy, data protection, or data security (“Personal Data”), and any confidential, sensitive, or proprietary data (collectively as “Protected Information”)) used in connection with the business of the Company or its subsidiaries. The Company and its subsidiaries have established and maintained commercially reasonable disaster recovery and security plans, procedures and facilities for their business, including, without limitation, for the IT Systems, Protected Information and data held or used by or for the Company and its subsidiaries. There have been no actual or reasonably suspected or ongoing material breaches or attacks involving, violations of, outages involving, or accidental, unlawful, or unauthorized destruction of, loss of, alteration of, use of, or access to, any IT Systems or Protected Information (collectively as “Breach”);
(oo) Except as would not be reasonably expected to have a Material Adverse Effect, the Company and its subsidiaries have at all times complied with all (A) applicable laws, statutes, regulations, directives, rules, self-regulatory guidelines and standards concerning the protection, collection, use, disclosure, transfer, storage, disposal, confidentiality, integrity, availability, privacy, and security of IT Systems and Protected Information; and (B) judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, posted policies and contractual obligations, relating to the privacy and security of IT Systems and Protected Information and to the protection of such IT Systems and Protected Information from unauthorized use, access, misappropriation or modification (collectively, the “Data Protection Requirements”);
12