2025-733-E-AMS-Complete_with_DocuSign_Brady_Services_Whitte

Browse Search

Orange Co Whitted Chiller September 08, 2025 Page 17 of 18 © 2025 Trane Technologies. All Rights Reserved. Confidential and Proprietary Information of Trane U.S. Inc. purpose of providing the Equipment and Services, and will disclose Customer Confidential Information only: (i) to Trane’s employees and agents who have a need to know to perform the Services, (ii) as expressly permitted or instructed by Customer, or (iii) to the minimum extent required to comply with applicable law, provided that Trane (1) provides Customer with prompt written notice prior to any such disclosure, and (2) reasonably cooperate with Customer to limit or prevent such disclosure. 4. Customer Data; Compliance with Laws. Trane agrees to comply with laws, regulations governmental requirements and industry standards and practices relating to Trane’s processing of Customer Confidential Information (collectively, “Laws”). 5. Customer Data; Information Security Management. Trane agrees to establish and maintain an information security and privacy program, consistent with applicable HVAC equipment industry practices that complies with this Addendum and applicable Laws (“Information Security Program”). The Information Security Program shall include appropriate physical, technical and administrative safeguards, including any safeguards and controls agreed by the Parties in writing, sufficient to protect Customer systems, and Customer’s Confidential Information from unauthorized access, destruction, use, modification or disclosure. The Information Security Program shall include appropriate, ongoing training and awareness programs designed to ensure that Trane’s employees and agents, and others acting on Trane’s, behalf are aware of and comply with the Information Security Program’s policies, procedures, and protocols. 6. Monitoring. Trane shall monitor and, at regular intervals consistent with HVAC equipment industry practices, test and evaluate the effectiveness of its Information Security Program. Trane shall evaluate and promptly adjust its Information Security Program in light of the results of the testing and monitoring, any material changes to its operations or business arrangements, or any other facts or circumstances that Trane knows or reasonably should know may have a material impact on the security of Customer Confidential Information, Customer systems and Customer property. 7. Audits. Customer acknowledges and agrees that the Trane SOC2 audit report will be used to satisfy any and all audit/inspection requests/requirements by or on behalf of Customer. Trane will make its SOC2 audit report available to Customer upon request and with a signed nondisclosure agreement. 8. Information Security Contact. Trane’s information security contact is Local Sales Office. 9. Security Incident Management. Trane shall notify Customer after the confirmation of a Security Incident that affects Customer Confidential Information, Customer systems and Customer property. The written notice shall summarize the nature and scope of the Security Incident and the corrective action already taken or planned. 10. Threat and Vulnerability Management. Trane regularly performs vulnerability scans and addresses detected vulnerabilities on a risk basis. Periodically, Trane engages third-parties to perform network vulnerability assessments and penetration testing. Vulnerabilities will be reported in accordance with Trane’s cybersecurity vulnerability reported process. Trane periodically provides security updates and software upgrades. 11. Security Training and Awareness. New employees are required to complete security training as part of the new hire process and receive annual and targeted training (as needed and appropriate to their role) thereafter to help maintain compliance with Security Policies, as well as other corporate policies, such as the Trane Code of Conduct. This includes requiring Trane employees to annually re-acknowledge the Code of Conduct and other Trane policies as appropriate. Trane conducts periodic security awareness campaigns to educate personnel about their responsibilities and provide guidance to create and maintain a secure workplace. 12. Secure Disposal Policies. Trane will maintain policies, processes, and procedures regarding the disposal of tangible and intangible property containing Customer Confidential Information so that wherever possible, Customer Confidential Information cannot be practicably read or reconstructed. 13. Logical Access Controls. Trane employs internal monitoring and logging technology to help detect and prevent unauthorized access attempts to Trane’s corporate networks and production systems. Trane’s monitoring includes a review of changes affecting systems’ handling authentication, authorization, and auditing, and privileged access to Trane production systems. Trane uses the principle of “least privilege” (meaning access denied unless specifically granted) for access to customer data. 14. Contingency Planning/Disaster Recovery. Trane will implement policies and procedures required to respond to an emergency or other occurrence (i.e. fire, vandalism, system failure, natural disaster) that could damage Customer Data or any system that contains Customer Data. Procedures include the following (i) Data backups; and (ii) Formal disaster recovery plan. Such disaster recovery plan is tested at least annually. 15. Return of Customer Data. If Trane is responsible for storing or receiving Customer Data, Trane shall, at Customer’s sole discretion, deliver Customer Data to Customer in its preferred format within a commercially reasonable period of time following the expiration or earlier termination of the Agreement or, such earlier time as Customer requests, securely destroy or render unreadable or undecipherable each and every original and copy in every media of all Customer’s Data in Trane’s possession, Docusign Envelope ID: A027BEC4-9CD8-4C1F-889C-FED6DE495C39