Legal Statements & Disclosures

Conditions of Use

By using this website and other Intact Insurance Specialty Solutions sites that are linked to this website, you agree to the following terms and conditions. Please read them carefully. These terms and conditions may be revised at any time by our updating this notice and posting it on our website. You are bound by any such revisions and should periodically visit this page to review the most recent Terms and Conditions.

Copyright and Trademarks

These websites are owned by Intact Insurance Specialty Solutions. Unauthorized use of these sites, and/or the materials contained therein may violate applicable copyright, trademark or other laws. No part of the materials made available on these websites may be reproduced, stored in a retrieval system, or transmitted in any form or by any means electronic, mechanical, photocopying, recording, or otherwise without prior written approval. Materials displayed on these websites may be downloaded for personal, non-commercial use only, provided all copyright and other proprietary notices contained on the materials are retained.

Disclaimer

The information and descriptions contained in these websites are provided solely for informational purposes, and are not intended to be complete descriptions of all terms, exclusions, and conditions applicable to every insurance product or service offered by Intact Insurance Specialty Solutions. The materials on these websites are provided "as is" and without warranties of any kind either expressed or implied. To the fullest extent permissible under applicable law, Intact and its affiliates and distributors disclaim all warranties, express or implied, including but not limited to implied warranties of merchantability, fitness for a particular purpose, title and non-infringement. Intact does not warrant or make any representations regarding the accuracy, completeness, currency or reliability of any of the content on these websites, nor does it warrant or represent that the functions contained in the materials will be uninterrupted or error free, that defects will be corrected, or that this website or the server that makes it available are free of viruses or other harmful components.

Limitation of Liability

Intact assumes no responsibility and shall not be liable for any damage to your computer equipment or other property as a result of your access to, use of, or browsing in these websites, or your downloading of any materials, data, text, images, audio and video from these site or arising in connection with any failure of performance, error, omission, interruption, defect, computer virus, delay in operation or transmission, or line or system failure. You, and not Intact, assume the entire cost of all necessary servicing, repair or correction.

Under no circumstances, including, but not limited to, negligence, shall Intact Insurance Specialty Solutions be liable for any injury, loss, claim, damage, or any special, exemplary, punitive, indirect, incidental or consequential damages of any kind that arise from the use of, or the inability to use, these websites or the materials on these websites, whether based on warranty, contract, tort or any other legal theory, and even if Intact Insurance Specialty Solutions has been advised of the possibility of such damages.

Notwithstanding the foregoing, if Intact should be found liable for any loss or damage which arises out of or is in any way connected with any of the above described functions or uses of these sites or their content, Intact's liability, where permitted by law, shall not exceed, in the aggregate, the greater of:

1. the amount paid by you to access these sites, or

2. US $100.00

Hyperlinks

This website may be linked to other websites which are not maintained or controlled by Intact. Intact is not responsible for the content of those websites. The inclusion of any links does not imply approval or endorsement by Intact of those websites or their content. If you decide to access other websites, you do so at your own risk.

Indemnification

You shall indemnify and hold Intact, its affiliates, successors in interest, officers, directors, employees and agents harmless from and against any claim, cause of action or demand, including without limitation reasonable legal fees, brought by or on your behalf in excess of the liability described herein or by third parties as a result of your use of this site.

Privacy

Intact Privacy Policy may be accessed here. The Policy explains what information Intact may collect from you including financial information used for payment transactions if you decide to provide such information, and how we will use and protect that information.

Governing Law

These terms and conditions of this Agreement shall be governed by and interpreted according to the laws of the Commonwealth of Massachusetts, without giving effect to Massachusetts' conflict of law principles.

Severability

If any provision of this Agreement shall be determined to be unenforceable or invalid, such provision shall nonetheless be enforced to the fullest extent permitted by applicable law, and such determination shall not affect the validity and enforceability of any other remaining provisions.

Termination

Intact reserves the right to terminate your access to any Intact secured site at any time.

Confidentiality Protocol for Victims of Domestic Violence/Endangered Individuals

New York Insurance Law § 2612 provides victims of domestic violence with certain protections including prohibiting an individual, insurer or entity supervised by the Department of Financial Services, solely because a person is or has been a victim of domestic violence, from:

1. Refusing to issue or renew, deny or cancel any insurance policy or contract;

2. Demanding or requiring a greater premium or payment from any person;

3. Designating domestic violence as a preexisting condition for which coverage will be denied or reduced; and

4. Using the fact that a person is or has been a victim of domestic violence as an underwriting criterion.

New York Insurance Law § 2612 also requires that certain insurers establish procedures to protect and limit access to certain personal information related to a victim of domestic violence.

New York Insurance Law § 2612 provides that if any person covered by an insurance policy delivers to the insurer a valid court order of protection issued by a court of competent jurisdiction in New York State against the policyholder or other person covered by the policy, then the insurer is prohibited for the duration of the order from disclosing to the policyholder or other person the address and telephone number of the insured, or of any person or entity providing the covered services to the insured. If a child is a covered person, then the right may be asserted by the child’s parent or guardian.

New York Insurance Law § 2612 also requires a health insurer, as defined in that section of the law to include an accident and health insurer, to accommodate a reasonable request made by a person covered by an insurance policy to receive communications of claim-related information by alternative means or at alternative locations if the person clearly states that disclosure of the information could endanger the person. If the covered person is a child, then the right may be asserted by the child’s parent or guardian. The law further provides that, except with the express consent of the person making the request, a health insurer may not disclose to the policyholder: (1) the address, telephone number, or any other personally identifying information of the person who has made the request or child for whose benefit a request was made; (2) the nature of the health care services provided; or (3) the name or address of the provider of covered services.

Procedure: To invoke these protections as regards coverages provided through any Intact Insurance Specialty Solutions underwriting company, please mail a valid order of protection to the address shown below. For all requests, please send a written explanation of your request, with your name, phone number, mailing address and email address, if any, to:

Joseph Topale
Chief Information Security Officer
150 Royall Street
Canton, MA 02021
1-781-332-7000
PrivacyandSecurity@intactinsurance.com

To contact the New York State Domestic and Sexual Violence Hotline, please call 1-800-942-6906 (English) or 1-800-942-6908 (Spanish).

Producer Compensation Practices

The insurance companies that are part of the Intact Insurance Specialty Solutions family of companies (hereinafter “us,” “we” or “Intact”) distribute their products through licensed independent insurance agents and insurance brokers, commonly referred to as “producers.” These producers are generally not our employees. However, they often receive compensation from us for placing insurance with Intact. Depending upon the producer’s business relationship with us, that compensation is in one or more of three forms: standard or base commission, contingent commission and other or additional compensation. An overview of each of these forms of compensation is provided below.

Standard or Base Commission

When new or renewal policies are sold, we pay a fixed or predetermined commission to the producer. The amount of the commission is normally based on a percentage of the premium, although occasionally the commission can be a fixed amount either negotiated with the producer or determined by statute or regulation. During 2005 our standard or base commissions ranged from 0 to 28.5% of premium depending on a variety of factors including the line of business, risk classification, the specific producer and the state where the risk is located. The total standard or base commission paid during 2005 by Intact Insurance Specialty Solutions to all producers was 15% of net direct written premiums for the year. In instances where more than one producer may be involved in the placing of the insurance, such as when a wholesaler or aggregator is involved in the transaction, more than one producer may receive a fixed commission or the fixed commission may be paid to more than one producer

Contingent Commission

In addition to fixed commission producers may be eligible to receive a contingent commission, which is payable if the producer meets or has met certain pre-defined profitability goals related to the producer’s book of business with Intact Insurance Specialty Solutions. However contingent commission is not offered on all products or lines of business. Where offered, the applicable annual goals will vary by line of business and may include in addition to a required minimum profit as measured by loss ratio and minimum total premium amounts, a number of factors such as volume of premiums or new business, growth in business with Intact companies or retention of policyholders or premium. If in a given year a producer does not meet the applicable annual goals, that producer is not eligible for a contingent commission and thus receives no contingent commission payment from us.

Contingent commission payments are normally an amount equal to a percentage of eligible premiums placed by the producer with us. The total contingent commission paid during 2005 by Intact to all producers was 1% of net direct written premiums for the year.

Other (Additional) Compensation

Producers may receive other forms of compensation from us such as information technology services and expense reimbursement for such items as adverting, marketing and underwriting expenses. We may pay for, or directly provide, professional continuing education opportunities for producers. Producers may participate in sales contests or promotions based upon the submission of proposed new business to us. Intact may also pay for meals and other entertainment expenses including the travel, meals and accommodations arising from company sponsored events. Payment of other compensation may depend on the producer meeting production and other performance objectives established by us.

Intact may enter into relationships with producers whereby the producer provides additional services on behalf of Intact. In these instances the producer may perform some underwriting or administrative services for which payment of a service fee is appropriate. Such arrangements represent a very small portion of Intact’s producer compensation payments.

Interest on premiums collected by producers on our behalf and placed in interest bearing trust accounts before the premium is paid to us is generally retained by the producer, provided that producers comply with any applicable disclosure or other regulatory or legal requirements.

Intact Insurance Specialty Solutions Producer Ownership

Intact or its subsidiaries own and operate a small number of insurance agencies. These agencies are listed at “Company Overview”. In addition a small number of Intact employees are licensed insurance agents. These agencies and employees may serve as a producer for Intact as well as other insurance companies not affiliated with Intact. As producers these agencies and employees may be eligible for the similar compensation arrangements as producers not owned by Intact.

Additional Information

This synopsis provides an overview of Intact Insurance Specialty Solutions producer compensation practices. However, because it is only a general overview there may be exceptions not addressed above. If you need additional information regarding specific producer compensation please contact your producer directly. Also, please periodically check this website for updated information.

INFORMATIONAL NOTICE TO POLICYHOLDERS

OneBeacon Insurance Group has rebranded as Intact Insurance Specialty Solutions. This is the marketing brand for the insurance company subsidiaries (including Atlantic Specialty Insurance Company) of Intact Insurance Group USA LLC, a member of Intact Financial Corporation (TSX: IFC), the largest provider of property and casualty insurance in Canada and a leading specialty insurance carrier in North America.

Atlantic Specialty Insurance Company will continue to operate under its current name. The marketing brand change has no impact on policies in force and does not change, amend, or waive any of the policy’s terms.

This notice is for information only and does not become a part or condition of this policy.

These SMS Terms and Conditions (“SMS Terms”) apply to any use of SMS messaging as part of the Intact Insurance USA SMS Program which provides notifications and verification codes to Intact customers, including confirmations of claims submissions and on-demand unique verification codes sent via text message to a customer’s mobile phone for online users (the “Service”).

1. When you opt-in to receive SMS as part of the Service, we will send you an SMS message to confirm your signup and/or a unique verification code. Messages received as part of the Service may include information from your insurance carrier, broker, or agent relating to your insurance claims.

2. You can cancel the SMS service at any time. Just text "STOP" to the short code. After you send the SMS message "STOP" to us, we will send you an SMS message to confirm that you have been unsubscribed. After this, you will no longer receive SMS messages from us. If you want to join again, just sign up as you did the first time and we will start sending SMS messages to you again.

3. If you are experiencing issues with the messaging program you can reply with the keyword “HELP” for more assistance, or you can get help directly at esupport@intactinsurance.com or +1 877-248-9500. After you send the SMS message "HELP" to us, we will respond with instructions on how to use our service as well as how to unsubscribe.

4. Carriers are not liable for delayed or undelivered messages. Intact Insurance USA SMS Program is available on all major US carriers.

5. Message and data rates may apply for any messages sent to you from us and to us from you. The frequency of messages you will receive will depend on the number of pending claims and interactions you have with the Service. If you have any questions about your text plan or data plan, it is best to contact your wireless provider. For all questions about the services provided by this short code, you can send an email to esupport@intactinsurance.com.

6. If you have any questions regarding privacy, please read our privacy policy: Intact Customer Privacy Policy.

Right to Work poster

Right to Work Participation Poster

1. AGREEMENT: This Purchase Order (“Order”) is a binding contract, subject to the terms and conditions hereof, unless objected to by Vendor in writing prior to shipment or commencement of services. All additions, exceptions, or modifications must be agreed to in writing by Intact Insurance Group USA LLC (“Intact”).

2. PRICE AND PAYMENT: Unless otherwise stated, the prices stated on the Order include all discounts and include charges for packing, shipping and taxes. Payment will be made within thirty (30) days of receipt of invoice after acceptance of the goods and/or services.

3. CHANGES: Intact shall have the right at any time to make changes to the Order upon notice to Vendor. If Vendor does not object in writing within ten (10) days or before scheduled delivery of the goods and/or services, the revision will be deemed accepted and the adjustment will be made on the next invoice.

4. WARRANTY: Vendor warrants that (1) the goods and/or services shall conform to this order, to specifications, drawings and/or other documentation, and shall be free from defects in materials and workmanship and (2) it has clear title to the goods and that the services will be performed in a professional and workmanlike manner. If the Order, or any part thereof, is found not to be as warranted, Intact may (a) rescind the Order; (b) accept such Order at a mutually agreeable reduction in price; or (c) reject the non-conforming portion of the Order. If Intact is required to return any portion of the Order due to a defect, Vendor shall be liable for all incidental costs. Rights granted to Intact are in addition to any other rights or remedies, including those under the Uniform Commercial Code.

5. TITLE AND RISK OF LOSS: Terms of shipping are F.O.B. Intact’s delivery location unless otherwise stated in the Order. Risk of loss shall not pass to Intact until the Order has been inspected, tested, and accepted by Intact.

6. INDEMNITY: Vendor agrees to indemnify, defend and hold harmless Intact from any and all claims, actions, liabilities, damages, costs and expenses, including reasonable attorneys' fees and expenses, arising out of (a) any third party claims of infringement of any patents, copyrights, license, trademarks, service marks or any other intellectual property right (b) the acts and omissions of Vendor, its employees, subcontractors, and/or agents. The provisions of this Section are in addition to all other remedies available to Intact and shall survive termination of this Order.

7. COMPLIANCE WITH LAWS & STANDARDS OF CONDUCT: Vendor shall comply with all applicable federal, state, and local laws and regulations. In the event that Vendor’s employees or contractors perform any of the Services at a Intact site, such employees and contractors shall comply with all applicable Intact policies.

8. FORCE MAJEURE: Vendor shall notify Intact in writing promptly of any delays to the timely performance of this Order. If Vendor is unable to complete performance at the time specified for delivery, by reasons either within or beyond its control, Intact shall have the option to find substitute services or to cancel the Order with no further obligation or liability to Vendor.

9. TERMINATION: Intact may terminate this Order at any time without incurring liability except for accepted goods or services. Either party may terminate this Agreement in the event of the other’s failure to comply with any material term of this Agreement and such noncompliance remains uncured for more than thirty (30) days after notice thereof.

10. ASSIGNMENT: This Order is non-assignable by Vendor.

11. INSURANCE REQUIREMENTS: Vendor is required to maintain insurance at its sole cost from insurance companies and in a form satisfactory to Intact in accordance with the limits of liability required by Intact. If requested, certificates of insurance, and any renewal notices, must be furnished to Intact, and any change or cancellation requires 30 days prior written notice to Intact.

12. LIMITATION OF LIABILITY: Except for the indemnity section of this order, neither party shall be liable for special, indirect, incidental, exemplary, or consequential damages (including, but not limited to, loss of profits, loss of use, or loss from business disruption, even if advised of the possibility of such damages).

13. GOVERNING LAW: This Agreement shall be governed by and construed in accordance with the laws of the State of New York.

14. PUBLICITY: Vendor agrees not to publish or use advertising or publicity matter without the prior written consent of Intact, which consent shall not be unreasonably withheld.

15. GENERAL PROVISIONS: The invalidity or unenforceability of any provision hereof shall not affect the validity or enforceability of any other provision. No amendment to this Agreement shall be binding on either party unless such amendment is in writing and executed by authorized representatives of both parties. A waiver by either party of a breach of any of the terms or provisions of this Agreement shall not operate or be construed as a waiver of any subsequent breach.

This schedule (“Schedule”) sets forth the terms and condition on which Service Provider will process Confidential Information when providing goods and services to Intact Insurance Group USA LLC and its direct and indirect affiliates (collectively, “Customer”) under the Services Agreement (the “Agreement”).

1. If the terms of this Schedule conflict with the terms of any other agreement between the parties, the terms of this Schedule shall control. Capitalized terms not defined herein shall have the meanings ascribed to them in the Agreement. All references to the Agreement in this Schedule refer to the Agreement as modified or supplemented by this Schedule.

2. Definitions. As used herein, the following terms have the meanings set forth below:

“Applicable Law” means any statute, law, ordinance, regulation, rule, code, order, constitution, treaty, common law, judgment, decree, directive or other requirement, guideline or rule of law of any governmental authority.

"Artificial Intelligence Technology" means technologies related to image recognition, audio processing, data classification, virtual agents, machine learning, deep learning, large language models, generative AI, and any other similar technologies (or evolutions of such technologies).

“Authorized Employees” means Service Provider’s employees who have a need to know or otherwise access Confidential Information to enable Service Provider to perform its obligations under this Agreement.

“Authorized Persons” means (i) Service Provider’s Authorized Employees; and (ii) Service Provider’s contractors, agents, service providers and auditors who have a need to know or otherwise access Confidential Information in connection with the Agreement, and who are bound in writing by confidentiality and other obligations sufficient to protect Confidential Information in accordance with the terms and conditions of this Agreement.

“Confidential Information” means all information of the Customer or its Affiliates that is furnished by or on behalf of the Customer, in whole or in part, together with all notes, analyses, compilations, studies, interpretations or other documents to the extent containing or otherwise reflecting, in whole or in part, any such information. Additionally, “Confidential Information” includes (i) Personal Information; (ii) the fact that such information has been or will be so furnished and (iii) the terms and existence of this Agreement and the content.

“Customer Systems” means information technology infrastructure, including the computers, software, databases, electronic systems (including database management systems), and networks, of Customer or any of its designees.

“Personal Information” means information Service Provider Processes under the Agreement that: (i) that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, or (ii) is otherwise identified as protected personal information under Applicable Law.

“Processing, processes, or process” means any activity that involves the use of Confidential Information. It includes obtaining, creating. accessing, recording, or holding the data, or carrying out any operation or set of operations on the data including, but not limited to, organizing, amending, retrieving, using, disclosing, erasing, encrypting, decrypting, or destroying it. Processing also includes transferring Confidential Information to third parties.

“Representatives” means, with respect to any party, any of the person or entity’s Affiliates, directors, officers, managers, employees, agents or professional advisers, to whom the party discloses Confidential Information.

“Security Breach” means any act or omission that compromises the security, confidentiality, availability or integrity of Confidential Information or the physical, technical, administrative, or organizational safeguards put in place to protect it. The loss of or unauthorized access, disclosure, or acquisition of Confidential Information is a Security Breach whether or not the incident rises to the level of a security breach under Applicable Law.

3. Information Security.

3.1. WISP. Service Provider shall implement and maintain a written information security program, including appropriate policies, procedures, and risk assessments that are reviewed at least annually.

3.2. Safeguards. Without limiting Service Provider’s obligations under Section 3.1, Service Provider shall implement administrative, physical, and technical safeguards to protect Confidential Information from unauthorized access, acquisition, or disclosure, destruction, alteration, accidental loss, misuse, or damage that are no less rigorous than accepted industry practices, and shall ensure that all such safeguards, including the manner in which Confidential Information is Processed, comply with Applicable Law and the terms and conditions of this Agreement.

3.3. PCI. If Service Provider Processes credit, debit, or other payment cardholder information in the course of Service Provider’s engagement by Customer, Service Provider shall at all times remain in compliance with current Payment Card Industry Data Security Standard ("PCI DSS") requirements, including remaining aware at all times of changes to the PCI DSS and promptly implementing all procedures and practices and self-assessments as may be necessary to remain in compliance with the PCI DSS, in each case, at Service Provider’s sole cost and expense.

3.4. Minimum Safeguards. At a minimum, Service Provider’s safeguards for the protection of Confidential Information and information systems shall include:

(i) limiting access to Confidential Information to extent required by Applicable Law;

(ii) securing business facilities, data centers, paper files, servers, scheduled and verified backup systems, and computing equipment, including, but not limited to, all mobile devices and other equipment with information storage capability;

(iii) implementing network, application, database, and platform security;

(iv) securing information transmission, storage, and disposal;

(v) implementing commercially reasonable authentication and access controls within media, applications, operating systems, commercial software and equipment;

(vi) implementing multi-factor authentication (MFA) for any individual accessing Provider Systems;

(vii) encrypting Confidential Information stored at rest;

(viii) encrypting Confidential Information transmitted over public or wireless networks;

(ix) strictly segregating Confidential Information from information of Service Provider or Service Provider’s other customers so that Confidential is not commingled with any other types of information;

(x) no less than annually, conducting risk assessments and penetration testing and promptly implementing, at Service Provider’s sole cost and expense, a corrective action plan to correct any issues that are reported as a result;

(xi) no less than quarterly, conducting vulnerability scans and promptly implementing, at Service Provider’s sole cost and expense, a corrective action plan to correct any significant issues that are reported as a result of the testing, ensuring that vulnerabilities are remedied and patches installed on an accelerated basis for zero-day, critical and high vulnerabilities. For zero-day vulnerabilities, implementing appropriate mitigation measures promptly on notification of the zero-day vulnerability. Remediating zero-day, high and critical vulnerabilities through patching, decommission, or compensating controls. Patching high vulnerabilities within 30 days or less of discovery and patch medium vulnerabilities within 90 days or less of discovery;

(xii) implementing appropriate personnel security and integrity procedures and practices, including, but not limited to, conducting background checks consistent with Applicable Law; and

(xiii) providing appropriate privacy and information security training to Service Provider’s employees and to any Authorized Person;

(xiv) maintaining commercial off-the-shelf software in accordance with manufacturer recommendations, including applying all security patches and hotfixes no later than the next release of patches and hotfixes from the manufacturer;

(xv) maintaining all hardware in accordance with the manufacturer’s recommended guidelines, including patching of all Firmware / BIOS levels no later than the next release of firmware and BIOS Levels unless other circumstances impacting the business prevent this action;

(xvi) implementing endpoint controls including appropriate use of malware detection, whitelisting, encryption, and media protections;

(xvii) maintaining a formalized crisis response plan, a formalized disaster recovery plan along with proof of test results, and a formalized business continuity plan.

3.5. Authorized Persons. During the term of each Authorized Person’s employment by Service Provider, Service Provider shall at all times cause such Authorized Person to abide by Applicable Law and to strictly abide by Service Provider’s obligations under this Agreement and Service Provider’s standard policies and procedures. Service Provider shall maintain a disciplinary process to address any unauthorized access, use, or disclosure of Confidential Information by any of Service Provider’s officers, partners, principals, employees, agents, or contractors.

3.6. Network Diagram. Upon Customer's written request, Service Provider shall provide Customer with a network diagram that outlines Service Provider’s information technology network infrastructure and all equipment used in relation to fulfilling its obligations under this Agreement, including, without limitation: (i) connectivity to Customer and all third parties who may access Service Provider’s network to the extent the network contains Confidential Information; (ii) all network connections, including remote access services and wireless connectivity; (iii) all access control measures (for example, firewalls, packet filters, intrusion detection and prevention services, and access-list-controlled routers); (iv) all backup or redundant servers; and (v) permitted access through each network connection.

3.7. Hosting. Service Provider agree to host, store, and Process Confidential Information only in the United States or Canada, unless otherwise expressly authorized in writing by Customer.

3.8. Provider Systems. Service Provider shall be solely responsible for the information technology and Security infrastructure, including but not limited to all computers, software, databases, electronic systems (including database management systems, storage devices and cloud services), and networks used by or for Service Provider (including third party systems and services) to deliver the services (“Provider Systems”) and shall monitor, patch and prevent unauthorized access to the Customer Systems through the Provider Systems. Service Provider will take action to mitigate exposure when new vulnerabilities are found based on severity, especially for zero-day exploits.

3.9. Subcontractors. Service Provider shall immediately disclose to the Customer the use of subcontractors that may have access to or use of Customer Systems or Confidential Information. Customer shall have the ability to reject the use of any subcontractors for work on Customer Systems or Confidential Information at any time. Notwithstanding the foregoing, Service Provider shall remain responsible and liable for all subcontractors, sub‑processors, downstream service providers or other third parties used by Service Provider in the provision of Service Provider’s services. Consultant shall conduct and document risk-based due diligence and ongoing oversight of all subcontractors, sub‑processors, downstream service providers and third parties that access or Process Confidential Information or Customer Systems to verify the adequacy of their cybersecurity practices, including but not limited to controls relating to access management, encryption, incident response, and vulnerability management..

4. Security Incidents.

4.1. Contact. Service Provider shall provide Customer with the name and contact information of one of Service Provider’s employees who shall serve as Customer's primary security contact and shall be available to assist Customer 24 hours per day, 7 days per week as a contact in resolving obligations associated with a Security Breach.

4.2. Notification to Customer. Service Provider shall notify Customer of a Security Breach as soon as practicable, but no later than 24 hours after Service Provider become aware of it by email at privacyandsecurity@intact.com, with a copy by email to Service Provider’s primary business contact within Customer.

4.3. Breach Response. Immediately following Service Provider’s notification to Customer of a Security Breach, Service Provider shall coordinate with Customer to investigate the Security Breach. Service Provider agree to cooperate with Customer in Customer’s handling of the matter, including, without limitation: (i) assisting with any investigation; (ii) providing Customer (or its designated representative) with physical access to the facilities and operations affected; (iii) facilitating interviews with Service Provider’s employees and others involved in the matter; and (iv) making available all relevant records, logs, files, archives, data reporting, and other materials required to comply with Applicable Law, regulation, industry standards, or as otherwise required by Customer.

4.4. Containment. Service Provider shall at Service Provider’s own expense use best efforts to immediately contain and remedy any Security Breach and prevent any further Security Breach, including, but not limited to taking any and all action necessary to comply with Applicable Law.

4.5. Indemnity. In addition to any indemnification obligations contained in the Agreement, Service Provider shall reimburse Customer for the expenses incurred by Customer with respect to a cybersecurity incident involving its information system that impacts Customer’s data, including but not limited to all costs of notice and/or remediation. If Customer reasonably determines that Service Provider has breached any material term of this Schedule, Customer shall have the right, at its sole discretion, to require timely remediation and/or terminate the underlying Agreement early with no penalty to Customer.

4.6. Notification to Third Parties. Service Provider agrees that Service Provider shall not inform any third party of any Security Breach without first obtaining Customer's prior written consent, other than to inform a complainant that the matter has been forwarded to Customer's legal counsel. Further, Service Provider agrees that Customer shall have the sole right to determine: (i) whether notice of the Security Breach is to be provided to any individuals, regulators, law enforcement agencies, consumer reporting agencies, or others as required by law or regulation, or otherwise in Customer's discretion; (ii) the contents of such notice; and (iii) whether any type of remediation may be offered to affected persons, and the nature and extent of any such remediation.

4.7. Records. Service Provider agrees to maintain and preserve all documents, records, logs, backups and other data related to any Security Breach indefinitely or until otherwise instructed.

4.8. Cooperation. Service Provider agrees to fully cooperate at Service Provider’s own expense with Customer in any litigation, investigation, or other action deemed necessary by Customer to protect its rights relating to the use, disclosure, protection, and maintenance of Confidential Information.

5. Oversight of Security Procedures. Upon Customer's written request to confirm Service Provider’s compliance with this Agreement, Applicable Law and industry standards, Service Provider grant Customer or, upon Customer’s election, a third party on Customer's behalf, permission to perform an assessment, audit, examination, or review of all controls in Service Provider’s physical and/or technical environment in relation to all Confidential Information Service Provider Process. Service Provider shall fully cooperate with such assessment by answering all questions and inquiries and by providing access to knowledgeable personnel, physical premises, documentation, infrastructure, and application software that processes, stores, or transports Confidential Information for Customer pursuant to this Agreement. In addition, upon Customer's written request, Service Provider shall provide Customer with the written results of any audit performed by Service Provider or on Service Provider’s behalf that assesses the effectiveness of Service Provider’s information security program as relevant to the security and confidentiality of Confidential Information shared during the course of this Agreement.

6. Artificial Intelligence Technology.

6.1. Unless Customer provides written consent in advance in a separate written agreement, Service Provider shall not use any data obtained from Customer (including Customer Confidential Information or any Personal Information) to train, enhance, evaluate, fine-tune, or develop any Artificial Intelligence Technology. Upon request, Service Provider shall promptly provide Customer with particulars of all Artificial Intelligence Technology utilized by Service Provider (and its subcontractors) to provide the Services and/or deliverables, including the AI component inventory described in the AI / Generative AI Safeguards Section 6.2 below.

6.2. AI/GenAI Minimum Safeguards. To the extent Service Provider uses any Artificial Intelligence Technology to provide the Services or to process Customer Data, Service Provider shall:

i. not use Customer Data (including prompts, chat logs, outputs, embeddings, or telemetry) to train, fine-tune, evaluate, or improve any model except as necessary to provide the Services and only with Customer’s prior written consent (opt-in);

ii. implement administrative, technical, and physical controls to protect Customer Data within AI Systems, including access controls, least-privilege tool permissions, and protections against prompt injection, sensitive data disclosure, insecure output handling, and abusive/unbounded consumption;

iii. maintain transparency of AI sub-processors/model providers (an AI component inventory) and provide notice of material changes to AI components that affect Customer Data processing;

iv. retain AI interaction data (prompts/outputs/logs/embeddings) only for the minimum period necessary for the Services and as otherwise required by law, and protect such data as Confidential Information;

v. ensure these obligations pass down to all AI-related sub-processors, subcontractors and third parties and remain responsible for their performance, acts and omissions; and

vi. treat AI-related security events (including data leakage via prompts/outputs/logs, unauthorized tool actions, or model supply chain compromise) as Security Incidents subject to Section 4.

7. Deletion & Disposal. Upon termination and after Customer has retrieved any required data (or as otherwise instructed by Customer) Service Provider will delete or destroy all of Customer’s data in accordance with standard best practices such as NIST 800-88 Guidelines for media sanitation; provided however, that Service Provider will not be required to remove copies of Customer data from Service Provider’s backup media and servers until such time as the backup copies are scheduled to be deleted in the normal course of business; provided further that in all cases Service Provider will continue to protect the Customer data. All Confidential Information of Customer stored on any Systems shall be rendered unrecoverable prior to the disposal of such Systems.

8. Use of Personal Information. For purposes of this Section, capitalized terms not previously defined shall have the meanings given to such terms in the California Consumer Privacy Act of 2018, Cal. Civil. Code 1798.100 et seq., as amended by the California Privacy Rights and Enforcement Act of 2020, and any regulations promulgated thereunder (“CCPA”). “Intact Personal Information” shall mean Personal Information that Service Provider receives from or on behalf of Customer as part of the provision of Services under the Agreement. “Contracted Business Purposes” shall mean the Services described in the Agreement for which Service Provider receives or accesses Intact Personal Information.

8.1. Service Provider shall process Intact Personal Information in furtherance of the Business Purposes under applicable law only. Service Provider shall not sell or share the Intact Personal Information, nor retain, use, or disclose Intact Personal Information for any purpose other than performing Service Provider’s obligations pursuant to this Agreement. Service Provider shall not combine the Intact Personal Information with personal information received from another party or directly from the individual unless permitted by regulation.

8.2. Service Provider shall notify Customer if Service Provider receives a CCPA request regarding Intact Personal Information. Service Provider shall provide reasonable assistance to Customer to meet its response obligations under applicable law. As required by applicable law, Service Provider shall comply with deletion and access requests for Intact Personal Information.

8.3. Both parties will comply with all applicable requirements of the CCPA when collecting, using, retaining, or disclosing personal information. Service Provider certify that it understands this Agreement's and the CCPA's restrictions and prohibitions on selling personal information and retaining, using, or disclosing personal information outside of the parties' direct business relationship, and will comply with them.

8.4. Service Provider warrants that it has no reason to believe any CCPA requirements or restrictions prevent Service Provider from providing any of the Contracted Business Purposes or otherwise performing under this Agreement. Service Provider must promptly notify Customer of any changes to the CCPA's requirements that may adversely affect Service Provider’s performance under the Agreement or Service Provider’s ability to comply with the CCPA.

8.5. Service Provider grants Customer the right to (1) take reasonable and appropriate steps to help ensure that Service Provider is using the Intact Personal Information in a manner consistent with the Customer's CCPA obligations (including but not limited to monitoring contract compliance through administrative measures); and (2) upon notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Intact Personal Information.

9. Guidelines for Remote IT Workers. If Service Provider provides remote IT workers to Customer as a part of its services, Service Provider agrees to adhere to the following guidelines when verifying their backgrounds and identities:

9.1. Interview Requirements (In-Person or Video). All services providers who provide remote IT workers must verify candidate location via in-person or video interview only — no voice-only or chat-based interviews.

Video Interview Protocol

a. Before the Interview:

Obtain a copy of the candidate’s government-issued ID.

Review the candidate’s digital profile (e.g., LinkedIn) to verify experience.

b. During the Interview:

Ensure screen filters are disabled.

Ask targeted questions to verify location and background.

Have the candidate present their original ID on camera to cross-check with the electronic copy.

Confirm the candidate’s right to work in the jurisdiction.

Conduct live problem-solving and technical assessments relevant to the role.

Apply safeguards to detect deepfake usage (e.g., delayed responses, unnatural eye movement, lip-sync issues, mechanical voice, scripted answers).

c. Sample Targeted Interview Questions:

Camera & Work Setup Validation: Ask for live views of daylight, electrical outlets, clocks, or work furniture.

Location Anchoring: Ask about local landmarks, restaurants, sports teams, weather, etc.

Courier & Delivery Validation: Ask about delivery services used and return processes.

Work Schedule & Environment: Ask about daily routines, workspace setup, and handling of internet outages.

Red Flag Escalation: If concerns persist, consider asking about political topics (e.g., North Korean leadership) — impostors may avoid answering.

9.2. Mailing Address Verification. Service providers must send documents and equipment only to the address listed on the hire’s ID. If a different address is requested, obtain supporting documentation.

9.3. Credential Verification.

Verify credentials (e.g. educational and employment history and geographical affiliations, including ties to sanctioned entities or regions of concern) directly with issuing institutions — do not rely on contact information provided by the applicant.

Scrutinize documents and PII for forgery or inconsistencies.

Cross-check personal and professional details across platforms and documents.

9.4. Payment Safeguards.

Do not allow cryptocurrency payments.

Verify banking information against the hire’s ID.

Do not permit payments to third-party accounts.

About Intact Insurance Specialty Solutions: Intact Insurance Specialty Solutions is the marketing brand for the insurance company subsidiaries of Intact Insurance Group USA LLC. Coverages may be underwritten by one of the following insurance companies: Atlantic Specialty Insurance Company, a New York insurer; Homeland Insurance Company of New York, a New York insurer; Homeland Insurance Company of Delaware, a Delaware insurer; OBI America Insurance Company, a Pennsylvania insurer; or OBI National Insurance Company, a Pennsylvania insurer. Each of these insurers maintains its principal place of business at 605 Highway 169 N, Plymouth, MN 55441. For information about Intact Insurance Specialty Solutions products and services, visit intactspecialty.com.

This material is intended as a general description of certain types of insurance coverages and services. Coverages and availability vary by state; exclusions and deductibles may apply. Please refer to your insurance policy or consult with your independent insurance advisor for specific information about coverages, terms and conditions. Some coverage may be written by a surplus lines insurer through a licensed surplus lines broker. Surplus lines insurers do not generally participate in state guaranty funds and insureds are therefore not protected by such funds.