The Company, under the oversight of the audit committee of the board of directors (the “Audit Committee”), has implemented and maintains an enterprise risk management program that inter- alia contains a cybersecurity risk management program primarily designed to identify, assess, and mitigate critical risks from cybersecurity threats. Our cybersecurity risk management program incorporates elements of recognized industry standards, such as the ISO 27001 and ISO 27701. Our cybersecurity program includes safeguards such as firewalls, DDoS mitigation tools, and authentication controls.

We engage third-party service providers to assist us with our cybersecurity risk management. We have also engaged third party advisors and consultants to conduct periodic testing of our processes and systems, which includes annual audits designed to align to ISO and PCI standards. We also maintain a vendor management program whereby, before contracting with certain third parties, such as those that have access to sensitive information or our IT systems, we conduct diligence on those third parties. This third party diligence includes reviewing vulnerability assessments and the inclusion of compliance with the applicable data privacy requirements in the contracts, as appropriate. We have also implemented a process for employees to undergo cybersecurity training during onboarding.

We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors’ information systems. For more information, please see Item 3, part D - Risk Factors.

Our Infosec Team is responsible for the day-to-day oversight of cybersecurity risk assessment and management. This function works in close coordination with and reports to the Chief Information and Technology Officer, with whom they regularly discuss and review our information security and cybersecurity risk management processes.

Our board of directors has delegated oversight of the cybersecurity risk management program to our audit committee. The audit committee advises the board of directors in evaluating the effectiveness of risk management systems and in assessing compliance with risk management practices, including those specific to cybersecurity. In addition, our Chief Information and Technology Officer, with input from third party consultants as appropriate, provide a cybersecurity updates to the audit committee and board of directors, as required.