Way2B1 agrees that the data and information uploaded by Client (or Authorized Users of Client) that is stored or processed via the Software Services (the “Client Data”) shall be treated as confidential pursuant to Section 8 by Way2B1 and shall remain Client’s sole property. Subject to Client’s immediately revocable consent, Way2B1 and its Subcontractors may access Client Data only as reasonably necessary for Way2B1 to provide the Software Services to Client. Client Data will be made available promptly to Client, upon its request, in the form, and format reasonably requested by Client. For the avoidance of doubt, no Client Data may be sold, assigned, leased, or otherwise disposed of to third parties or commercially exploited by or on behalf of Way2B1. Neither Way2B1 nor any of its Subcontractors (as defined below), as applicable, may possess or assert any lien or other right against or to any Client Data. “Client Personal Information” means any information that, either individually or when combined with other information, could be used to distinguish or trace an individual’s identity. As between the parties, all Client Personal Information disclosed or otherwise made available to Way2B1 by or on behalf of Client will be considered Client’s property and Client’s Confidential Information (defined below). Way2B1 will restrict access to Client Personal Information on a need-to-know basis. Way2B1 will not disclose Client Personal Information to any third party (including Way2B1’s agents and contractors), nor permit any third party to have access to any Client Personal Information for any purpose except as required by law, or as reasonably necessary to perform the Software Services and in accordance with applicable laws; provided, however, Authorized Users (including for clarity, financial advisors and their representatives if authorized by Client) will be permitted by Way2B1 to access Client Data (including Client Personal Information). Way2B1 may not use, duplicate or retain records of Client Personal Information, except as reasonably necessary to perform the Software Services in accordance with this Agreement. Way2B1 will be responsible at Way2B1’s expense for complying with all applicable laws relating to Client Personal Information.

As part of the Software Services, Way2B1 will establish, implement and maintain a system of safeguards designed to: (i) prevent the destruction, loss, alteration and unauthorized access and use of Client Data in the possession or control of Way2B1 (or its Subcontractors, as applicable); (ii) permit Client Data to be returned to Client or disposed of; and (iii) meet (or exceed) and comply with applicable laws and applicable prevailing industry information security practices and standards, including relevant ISO standards, the standards set forth in the Way2B1 Digital Security and Compliance overview provided to Client, and the then-current SSAE SOC 2 Type II standards ("Information Security Program"). Way2B1 will, and will require its agents and contractors to, regularly test key controls, systems and procedures relating to the Information Security Program. The frequency and nature of such tests will be determined by Way2B1’s risk assessment organization in its reasonable discretion but in any event shall be sufficient to meet the standards and controls of the Information Security Program. Upon request, Way2B1 will provide Client with the results of all such tests and any other audit, review or examination relating to its information Security Program. All such information shall remain Way2B1’s Confidential Information. Way2B1 will notify Client immediately of any known, suspected or attempted unauthorized use, access, loss, disclosure, modification, or destruction of Client Data (each, a "Security Breach"). Way2B1 will promptly investigate each Security Breach, provide Client with a detailed written statement describing the circumstances surrounding each Security Breach, develop and provide a proposed remediation plan to address the Security Breach and prevent any further incidents and implement the proposed remediation plan. In addition, Way2B1 agrees to reasonably cooperate with Client in Client's handling of a Security Breach, including any investigation, reporting, disclosure or other obligations required by applicable law or regulation, or as Client may otherwise require. Way2B1 shall not notify any third party of, or make any public statement regarding, a Security Breach without Client's prior written authorization; provided however, Way2B1 shall be free to notify other Way2B1 clients to the extent that the Security Breach implicates other client data so long as any such notification does not identify Client or Client’s beneficial owner or family members as also being impacted by the Security Breach. Way2B1 shall be solely responsible for all costs and expenses incurred by Way2B1 and/or Client in responding to and mitigating damages resulting from a Security Breach caused by the negligence or misconduct of Way2B1 or its agents, contractors or employees, including, without limitation, costs and expenses relating to, arising from, or comprised of: (a) any regulatory fines, penalties or other costs imposed by a regulatory authority; (b) public relations and other similar crisis management services as may be reasonably appropriate under the circumstances; (c) legal and accounting fees and expenses associated with Client's investigation of and response to the Security Breach; and (d) reasonable costs arising out of or in connection with any Security Breach resulting in a requirement for legally required notices (collectively "Costs"). The parties shall, in good faith, allocate between themselves Costs related to Security Breaches not caused by the negligence or misconduct of Way2B1 of its agents, contractors or employees.

Except as otherwise set forth in this Agreement, Way2B1 is not responsible for maintaining and protecting backups of all Client Data directly or indirectly processed using the Software Services and that Way2B1 is not responsible for the failure to store, the loss, or the corruption of Client Data. Client agrees that Way2B1 and its affiliated entities will collect and track technical and related information about Client and Client’s use of the Software Services, including Client’s internet protocol address, the hardware and software that Client utilizes, and various usage statistics to assist with the necessary operation and function of the Software Services and for internal purposes only, including without limitation to facilitate in the provision of updates, support, invoicing, marketing by Way2B1, its affiliated entities, or its agents, and research and development, provided that all such data used for Way2B1’s internal purposes shall be anonymous and aggregated such that the applicable data cannot be associated with or used to identify Client or Client’s beneficial owner or family members. In the event that Way2B1 is required or ordered to disclose Client Data to a third party pursuant to judicial order or other compulsion of law, if legally permitted, Way2B1 shall take all commercially reasonable steps to provide the Client with prompt notice of any relevant order or basis for disclosure so as to allow Client to take whatever steps it can to object to such compulsory disclosure if Client so chooses and if requested by Client, Way2B1 shall reasonably assist Client, at Client’s expense, with respect to making any such objection.

Subject to the foregoing, Client agrees that any Client Data made available to Way2B1 through standard application controls can be utilized for the purposes of improving the Software Services, including but not limited to the addition of trained models and other machine learning techniques; provided, that when used for such purposes, the applicable Client Data shall be anonymous and aggregated such that it cannot be associated with or used to identify Client or Client’s beneficial owner or family members (except where agreed upon by both parties).

Way2B1 takes data privacy seriously and we make certain that third-party processor privacy policies align with our commitment to data privacy. We will never allow qualified third-party data and AI processors to retain and utilize Client Data for training, analysis, or internal product development. Our thorough vendor qualification process screens third-party processors to ensure they abide by these terms. We take every precaution to ensure data control is maintained within the Way2B1 platform, while also mitigating any risk with third-party vendors.

Client hereby consents to Way2B1 accessing and processing Client Data, which may include PII, to provide advanced technologies to the direct benefit of the Client. Features and solutions may include, but are not limited to, third party data processors, artificial intelligence (AI), machine learning (ML) and other personalized recommendation features. We take every possible cautionary step to ensure personal PII data is secure.

Way2B1 will be responsible for establishing, implementing, testing, and maintaining an effective business continuity plan to provide continuous access to, and support for, the Software Services to Client without interruption or material degradation of quality. At a minimum, Way2B1 must back up, archive and maintain duplicate or redundant systems that can fully recover the Software Services and all Client Data on a daily basis, and establish and follow procedures and frequency intervals for transmitting backup data and systems to Way2B1’s backup location. Such backup storage and systems will be located at a secure secondary location other than the location of Way2B1 's primary system(s) and Way2B1 tests database backup and restore processed at least annually. In addition to Way2B1’s backup strategy, Way2B1 also maintains multiple database clusters that span across multiple Availability Zones within each Region providing additional layers of high availability. Upon request, Way2B1 will provide Client with a summary copy of Way2B1's business continuity plan.

In the event that, Way2B1 determines that it is likely to become insolvent, or enter into receivership, or may become the subject of a voluntary or involuntary bankruptcy proceeding, or may make an assignment for the benefit of creditors; or that a substantial part of Way2B1 's property is or becomes subject to any levy, seizure, assignment or sale for or by any creditor or governmental agency, Way2B1 shall immediately notify Client and the parties shall work in good faith to discuss and determine whether there is a mutually agreeable solution to ensure Way2B1's business continuity for the remainder of the Term. If the parties are not able to successfully find a means to ensure Way2B1’s business continuity for the remainder of the Term, Way2B1 will take all commercially reasonable steps to transition and transfer to Client or its designated thirty party service provider all of the Client Data. In addition, Way2B1 shall continue to make the Software Services available through Client's dedicated instance for a period of time for Client to (i) wind down its current use of the Software Services, (ii) make a transition to alternate services providers, or (iii) make a transition in-house.