Identity Theft Coverage Summary of Benefits — Washington

Legal Rights & Agreement Rules · Restriction or exception

This summary does not replace the group policy, which holds all terms and exclusions

This document is only a summary of the benefits you receive as a customer of Cyber Protection Insurance Services Inc., the policyholder of a group policy. Benefits vary with the specific service package you are enrolled in, additional terms and conditions apply, a copy of the policy is available on request, and the full policy controls all terms, conditions and exclusions. Your entitlement to benefits under the group policy ends when your enrollment in any Insured Program ends. The overview points readers to this Summary of Benefits for more detail on the Identity Protection Benefits.

Supporting quotations

Please review the following Summary of Benefits for additional details on your Identity Protection Benefits.

This Summary of Benefits document provides only a summary of the benefits entitled to you as a customer of Cyber Protection Insurance Services Inc., the policyholder of a group policy (“the policy”). Based on the specific service package you are enrolled in, benefits may vary, as outlined below. This is a summary only. Additional terms and conditions apply. A copy of the policy will be made available upon request. Refer to the full policy for all terms, conditions, and exclusions. Your entitlement to benefits under the group policy will terminate upon termination of your enrollment in any Insured Program.

SIE SBS WA 09 25

© 2025, HSB Specialty Insurance Company. All rights reserved. Page 1 of 1

Qualifications & exceptions

• The document carries the form identifier "SIE SBS WA 09 25" and a 2025 copyright line for HSB Specialty Insurance Company.

Not stated here

• The group policy itself is not supplied, so terms outside this summary cannot be read here.
• The document states no effective date or policy period; it does not say what "09 25" in the form identifier means.
• The document does not say how a copy of the policy is requested.

Legal Rights & Agreement Rules · Restriction or exception

Washington surplus lines notice: not protected by the state guaranty association

The document states that the contract is registered and delivered as surplus line coverage under the Washington insurance code, Title 48 RCW, and that it is not protected by any Washington state guaranty association law. The notice is followed by the name "Corey Dunbar, HSB Associates, Inc."

Supporting quotations

This contract is registered and delivered as a surplus line coverage under the insurance code of the state of Washington, Title 48 RCW. It is not protected by any Washington state guaranty association law. Corey Dunbar, HSB Associates, Inc.

Qualifications & exceptions

• The text only names the person and company after the notice and does not state a role.

Not stated here

• The document does not say what role Corey Dunbar or HSB Associates, Inc. has.
• Title 48 RCW is cited by name only and is not supplied.

Legal Rights & Agreement Rules · Context

Insurer is HSB Specialty Insurance Company; provider and policyholder is Cyber Protection Insurance Services Inc.

The Schedule names HSB Specialty Insurance Company, of Hartford, Connecticut, as the Insuring Company; the "we", "us" and "our" in the benefits text refer to it. It names Cyber Protection Insurance Services Inc., of Phoenix, Arizona, as the Provider, the entity that provides the insured program. The introductory text calls the same company the policyholder of the group policy. Surfshark appears in the document only as part of the insured program name; the document does not name Surfshark as a party to the policy.

Supporting quotations

HSB Specialty Insurance Company

One State Street, P.O. Box 5024, Hartford, Connecticut 06102-5024

Cyber Protection Insurance Services Inc.

20860 N. Tatum Blvd., Suite 300, Phoenix, AZ 85050

Cyber Protection Insurance Services Inc., the policyholder of a group policy

Provider means the entity providing the insured program and shown as the Provider in the Schedule of this Summary of Benefits.

Not stated here

• The document does not say what relationship Surfshark has to the provider or the policyholder.

Legal Rights & Agreement Rules · Context

"We", "us" and "our" mean the Insuring Company, and paragraph titles do not change coverage

In this Summary of Benefits, "we", "us" and "our" refer to the Insuring Company named in the Schedule. Titles given to paragraphs are only there to help find provisions; they do not grant, define or restrict coverage. A reader should therefore rely on the operative text under a title rather than on the title itself.

Supporting quotations

The words “we”, “us” and “our” refer to the Insuring Company shown in the Schedule of this Summary of Benefits. Titles given to paragraphs throughout this Summary of Benefits are for assistance in finding applicable provisions. Titles do not grant, define or restrict coverage.

Legal Rights & Agreement Rules · Restriction or exception

Affected individual: a non-Member whose data a Member holds for family, personal or non-profit volunteer reasons

An affected individual is any person whose personally identifying information or personally sensitive information is lost, stolen, accidentally released or accidentally published by a data breach event covered under the policy. The person must be someone whose information a Member holds because of a family or personal relationship with the Member, or because of the Member's volunteer work for a non-profit organization. The term excludes any Member, anyone whose information the Member holds through activities or responsibilities with a for-profit organization (including organizations the Member owns or operates) or with a non-profit organization where the Member is a paid employee or contract worker, and any business, organization or entity: only an individual person may be an affected individual. Personally sensitive information means private information about an individual whose release requires notification of affected individuals under applicable law.

Supporting quotations

Affected individual means any person whose personally identifying information or personally sensitive information is lost, stolen, accidentally released or accidentally published by a data breach event covered under the policy. This definition is subject to the following provisions:

a. Affected individual must be someone whose personally identifying information or personally sensitive information is in the possession of a Member because of:

(1) A family or personal relationship with a Member; or

(2) The activities or responsibilities of a Member in connection with volunteer work for a non-profit organization.

b. Affected individual does not mean or include any of the following:

(1) Any Member.

(2) Anyone whose personally identifying information or personally sensitive information is in the possession of a Member because of the activities or responsibilities, of any Member in connection with a for-profit organization or in connection with a non-profit organization for which a Member is a paid employee or contract worker. Such organizations include, but are not limited to, organizations that a Member owns or operates.

(3) Any business, organization or entity. Only an individual person may be an affected individual.

Personally sensitive information means private information specific to an individual, the release of which requires notification of affected individuals under any applicable law.

but only to the extent that such corresponding coverages are included in the insured program

Qualifications & exceptions

• The definition of stolen identity event counts a data breach event only to the extent that matching coverage is included in the insured program; the Schedule card for this program lists Data Breach as Not Included.

Not stated here

• The definition of personally sensitive information refers to notification requirements under "any applicable law" without naming one.

Legal Rights & Agreement Rules · Context

Nuclear hazard is defined as any nuclear reaction, radiation or radioactive contamination and its consequences

Nuclear hazard means nuclear reaction, radiation or radioactive contamination, or any consequence of any of these, however caused and whether controlled or uncontrolled. The term is used by the nuclear hazard exclusion.

Supporting quotations

Nuclear Hazard means nuclear reaction, radiation or radioactive contamination, or any consequence of any of these, however caused and whether controlled or uncontrolled.

Legal Rights & Agreement Rules · Context

An occurrence groups events that happen together or share a source, cause or vulnerability in a policy period

Occurrence means all stolen identity events, cyber attack events, cyberbullying events, cyber extortion events, data breach events, fraud events, home title fraud events or identity theft events that either occur at the same time or arise during the same policy period from the same source, cause or vulnerability. Several events can therefore be treated as one occurrence.

Supporting quotations

Occurrence means all stolen identity events, cyber attack events, cyberbullying event, cyber extortion events, data breach events, fraud events, home title fraud events or identity theft events that:

a. Occur at the same time; or

b. Arise during the same policy period from the same source, cause or vulnerability.

Not stated here

• The document does not say in this definition how an occurrence affects limits or deductibles; the limits text that mentions occurrences is read in its own card.

Legal Rights & Agreement Rules · Restriction or exception

Stolen identity event: theft, release or misuse of a Member's personal data, counted only where covered

A stolen identity event means the theft, accidental release, publication or misappropriation of a Member's personally identifying information that results in, or could reasonably result in, wrongful use of that information. It includes cyber attack, cyberbullying, cyber extortion, fraud, home title fraud, data breach and identity theft events, but only to the extent that the corresponding coverages are included in the insured program. Under the Schedule for this program only the Case Management Service and Identity Theft Recovery coverages are included.

Supporting quotations

Stolen identity event means the theft, accidental release, publication or misappropriation of a Member’s personally identifying information that results in or could reasonably result in the wrongful use of the information. This includes a cyber attack event, cyberbullying event, cyber extortion event, fraud event, home title fraud event, data breach event or identity theft event, but only to the extent that such corresponding coverages are included in the insured program.

Identity theft event means the fraudulent use of social security number or other personally identifying information. This includes fraudulently using such information to establish credit accounts, secure loans, enter into contracts or commit crimes.

Qualifications & exceptions

• The Schedule card for this program lists the other seven coverages as Not Included.

Cross-references

• qualifies (model-proposed): Cyber attack coverage would pay data recovery, system restoration, cryptojacking and future loss avoidance costs — The stolen identity event definition counts a cyber attack event only to the extent that matching coverage is included in the insured program, which limits the Cyber Attack coverage grant for this program.

Legal Rights & Agreement Rules · Context

School administrator means a principal, vice principal, headmaster or dean

School administrator means a principal, vice principal, headmaster or dean. The term appears in the cyberbullying event definition as one of the people to whom a Member can report a cyberbullying event.

Supporting quotations

School administrator means a principal, vice principal, headmaster or dean.

Cyberbullying event means two or more similar or related cyberbullying acts. Such cyberbullying event must have caused harm significant enough for a Member to:

Qualifications & exceptions

• The Schedule card for this program lists Cyberbullying as Not Included.

Legal Rights & Agreement Rules · Restriction or exception

Coverage applies only if the event is first discovered during the policy period and reported within 60 days

The Stolen Identity Event Group Insurance applies only if all three conditions are met: there has been a stolen identity event involving the personally identifying information of a Member; the Member first discovers the event during the policy period for which the policy applies; and the event is reported to the insurer as soon as practicable, and in no event more than 60 days after the Member first discovered it.

Supporting quotations

COVERAGE REQUIREMENTS

This Stolen Identity Event Group Insurance applies only if all of the following conditions are met:

a. There has been a stolen identity event involving the personally identifying information of a Member; and

b. Such stolen identity event is first discovered by the Member during the policy period for which the policy is applicable; and

c. Such stolen identity event is reported to us as soon as practicable, but in no event more than 60 days after the date it is first discovered by the Member.

Not stated here

• The Schedule in this document does not give the policy period dates or say how to report an event.

Cross-references

• qualifies (model-proposed): Exclusion: events found or occurring before coverage began, and costs incurred over a year after the policy expires — The coverage requirement that a stolen identity event be first discovered during the policy period is narrowed by the exclusions for events discovered before inception, events first occurring more than 60 days before inception, and costs incurred over a year after the policy expires.

Legal Rights & Agreement Rules · Restriction or exception

Exclusions apply to all coverages and bar loss caused by or resulting from the listed events

The Exclusions section states that its exclusions apply to all coverages under the policy and that the insurer will not pay for loss, damage or expense caused by or resulting from the matters listed below. Because they apply to all coverages, they limit the Identity Theft Recovery and Case Management coverages that this program includes.

Supporting quotations

C. EXCLUSIONS

The following exclusions apply to all coverages under the policy.

We will not pay for loss, damage or expense caused by or resulting from:

Legal Rights & Agreement Rules · Restriction or exception

Exclusion: a Member's own criminal, fraudulent or dishonest acts, intentional violations, and criminal proceedings

The insurer will not pay for loss caused by or resulting from criminal, fraudulent or dishonest acts, errors or omissions by a Member, intentional violations of the law by a Member, a Member intentionally initiating or contributing to a covered loss event, or any criminal investigations or proceedings. These exclusions apply to all coverages under the policy, including the Case Management Service and Identity Theft Recovery coverages that the Schedule lists as included for this program.

Supporting quotations

Any of the following by a Member:

a. Criminal, fraudulent or dishonest acts, errors or omissions;

b. Intentional violations of the law; or

c. Intentionally initiating or contributing to a covered loss event.

Any criminal investigations or proceedings.

Not stated here

• The exclusion of "any criminal investigations or proceedings" has no stated exception, while the identity theft costs definition covers defense of criminal charges brought against a Member because of a third party using the Member's identity; the document does not say how the two fit together.

Cross-references

• contrast (model-proposed): Identity theft costs: re-filing, postage, credit reports and attorney help for listed identity theft problems — The exclusion of any criminal investigations or proceedings has no stated exception, while the identity theft costs definition covers an approved attorney defending criminal charges against a Member that arise from a third party using the Member's identity. The document does not say how the two fit together.

Legal Rights & Agreement Rules · Restriction or exception

Exclusion: bodily injury, third party liability, vehicle damage and fines, with two stated carve-outs

The insurer will not pay for loss caused by or resulting from physical damage or bodily injury, except as described in the Cyberbullying coverage; third party liability or legal defense costs, except as described in the Identity Theft Recovery coverage; damage to a motor vehicle, watercraft, aircraft or other vehicle; or fines or penalties. These exclusions apply to all coverages under the policy, including the Case Management Service and Identity Theft Recovery coverages that the Schedule lists as included for this program.

Supporting quotations

Any physical damage or bodily injury, except as described in coverage B.2.f. Cyberbullying.

Any third party liability or legal defense costs, except as described in coverage B.2.b. Identity Theft Recovery.

Any damage to a motor vehicle, watercraft, aircraft or other vehicle.

Any fines or penalties.

Qualifications & exceptions

• The bodily-injury carve-out refers to Cyberbullying coverage, which the Schedule card for this program lists as Not Included.

Legal Rights & Agreement Rules · Restriction or exception

Exclusion: devices outside Member control, business losses and costs to research or correct deficiencies

The insurer will not pay for damage to any device or system that is not owned or leased by a Member, or operated under the control of a Member or another Member; loss arising from any business, including a business owned or operated by a Member or employing a Member; or, except under the System Restoration part of Cyber Attack coverage, costs to research or correct any deficiency. These exclusions apply to all coverages under the policy, including the Case Management Service and Identity Theft Recovery coverages that the Schedule lists as included for this program.

Supporting quotations

Damage to any device or system that is not owned or leased by a Member, or operated under the Member's control or the control of another Member.

Loss arising from any business, including but not limited to any business owned or operated by any Member or any business employing any Member.

Except as specifically provided under the System Restoration portion of Cyber Attack coverage, costs to research or correct any deficiency.

Computing device means a desktop, laptop or tablet computer or Wi-Fi router or other internet access point. Such device must be owned or leased by a Member, as well as operated under the Member's control.

Connected home device means any electronic device, other than a computing device, that connects to the internet or to other electronic devices. This includes, but is not limited to, networked versions of any of the following:

Legal Rights & Agreement Rules · Restriction or exception

Exclusion: events found or occurring before coverage began, and costs incurred over a year after the policy expires

The insurer will not pay for loss from any stolen identity event first discovered by a Member before the inception of the Member's coverage under the policy; any stolen identity event first occurring more than 60 days before the inception of the Member's coverage; or costs or expenses associated with a stolen identity event that are incurred more than one year from the expiration date of the policy. These exclusions apply to all coverages under the policy, including the Case Management Service and Identity Theft Recovery coverages that the Schedule lists as included for this program.

Supporting quotations

Any stolen identity event first discovered by a Member prior to the inception of the Member's coverage under the policy.

Any stolen identity event first occurring more than 60 days prior to the inception of the Member's coverage under the policy.

Any costs or expenses associated with a stolen identity event if such costs or expenses are incurred more than one year from the expiration date of the policy.

Not stated here

• The document does not give the inception or expiration dates of a Member's coverage or of the policy.

Cross-references

• qualified by (model-proposed): Coverage applies only if the event is first discovered during the policy period and reported within 60 days — The coverage requirement that a stolen identity event be first discovered during the policy period is narrowed by the exclusions for events discovered before inception, events first occurring more than 60 days before inception, and costs incurred over a year after the policy expires.

Legal Rights & Agreement Rules · Restriction or exception

Exclusion: theft of a professional or business identity, nuclear hazard and governmental seizure of property

The insurer will not pay for loss caused by or resulting from the theft of a professional or business identity, any nuclear hazard (nuclear reaction, radiation or radioactive contamination or their consequences, however caused), or any governmental action, meaning destruction, confiscation or seizure of property by order of any governmental or public authority. These exclusions apply to all coverages under the policy, including the Case Management Service and Identity Theft Recovery coverages that the Schedule lists as included for this program.

Supporting quotations

The theft of a professional or business identity.

Any nuclear hazard.

Any governmental action, meaning the destruction, confiscation or seizure of property by order of any governmental or public authority.

Nuclear Hazard means nuclear reaction, radiation or radioactive contamination, or any consequence of any of these, however caused and whether controlled or uncontrolled.

Legal Rights & Agreement Rules · Restriction or exception

Exclusion: war, including cyber warfare, with attribution to a government-linked combatant judged on reasonable evidence

The insurer will not pay for loss caused by or resulting from war or any consequence of it, which includes cyber warfare (whether or not combined with physical combat), undeclared war, civil war, hostile action by military force or cyber measures (including defensive action) by any combatant, and insurrection, rebellion, revolution, usurped power, political violence or governmental action to defend against these, including related cyber action. Cyber warfare, measures and action include disruptive digital activities against a computer network or system intended to cause harm to further political or similar objectives or to intimidate people for such objectives, committed by a combatant. Attribution to a combatant is determined using reasonable evidence such as statements by an affected government or other authority, statements by widely recognized international bodies or alliances, or consensus opinion within relevant expert communities such as the cyber security industry. A combatant is a government, sovereign or other authority, or its agents. These exclusions apply to all coverages under the policy, including the Case Management Service and Identity Theft Recovery coverages that the Schedule lists as included for this program.

Supporting quotations

War, including the following and any consequence of any of the following:

a. Cyber warfare, whether or not occurring in combination with physical combat;

b. Undeclared war;

c. Civil war;

d. Hostile action by military force or cyber measures, including action in defending against or hindering an expected or actual attack, by any Combatant; or

e. Insurrection, rebellion, revolution, usurped power, political violence or action taken by governmental authority in defending against or hindering any of these, including cyber action in connection with any of the foregoing.

For purposes of this exclusion, cyber warfare, cyber measures and cyber action include, but are not limited to, the use of disruptive digital activities against a computer network or system with the intention to cause harm in order to further political or similar objectives, or to intimidate any person(s) in furtherance of such objectives, committed by a Combatant.

The attribution of an action to a Combatant will be determined by relying on reasonable evidence such as:

a. Statements by an impacted government, sovereign or other authority;

b. Statements by widely recognized international bodies (such as the United Nations) or alliances (such as the North Atlantic Treaty Organization); or

c. Consensus opinion within relevant expert communities such as the cyber security industry. Decisions about the presence or absence of war, hostile action, and other terms used in this exclusion will take into consideration the full range of available tactics, weapons and technologies at the time of the event giving rise to the loss.

Combatant means, for purposes of this exclusion, a government, sovereign or other authority, or agents acting on their behalf.

Not stated here

• The document does not say who makes the attribution decision beyond the evidence examples, or how disputes about it are resolved.

Legal Rights & Agreement Rules · Restriction or exception

Exclusion: outside network failures, data input errors and investment performance

The insurer will not pay for loss caused by or resulting from total or partial failure, interruption, reduced performance or damage to any electrical power supply network or telecommunication network not owned and operated by a Member (including the internet, internet service providers, DNS providers, cable and wireless providers, internet exchange providers, search engine providers and other telecommunications or internet infrastructure providers); any loss resulting directly or indirectly from errors or omissions by a Member or a financial institution in the input or processing of data; or any loss related to the financial performance of any investments. These exclusions apply to all coverages under the policy, including the Case Management Service and Identity Theft Recovery coverages that the Schedule lists as included for this program.

Supporting quotations

Total or partial failure or interruption of, reduction in performance of, or damage to any electrical power supply network or telecommunication network not owned and operated by a Member including, but not limited to, the internet, internet service providers, Domain Name System (DNS) service providers, cable and wireless providers, internet exchange providers, search engine providers, internet protocol networks (and similar networks that may have different designations) and other providers of telecommunications or internet infrastructure.

Any loss resulting directly or indirectly from any errors or omissions by a Member or a financial institution in the input or processing of data.

Any loss related to the financial performance of any investments.

Legal Rights & Agreement Rules · Restriction or exception

Exclusion: loss while not enrolled in good standing, and any Member whose primary residence is outside Washington

The insurer will not pay for any loss occurring while the primary Member is not an active customer in good standing of the provider and directly enrolled in the insured program, or for any Member whose primary residence is not located in Washington state (the source text reads "not located Washington state"). These exclusions apply to all coverages under the policy, including the Case Management Service and Identity Theft Recovery coverages that the Schedule lists as included for this program.

Supporting quotations

Any loss occurring while the primary Member is not an active customer in good standing of the provider and directly enrolled in the insured program.

Any Member whose primary residence is not located Washington state.

Primary member means a person who, at the time of the discovery of the stolen identity event, is a customer in good standing of the provider and is directly enrolled in the insured program.

Insured program means the package of products and/or services provided by the provider and shown under the Insured Programs section of the Schedule of this Summary of Benefits.

Not stated here

• The document does not say which date decides where the primary residence is, or what happens if a Member moves out of Washington after enrolling.
• The document does not define "customer in good standing".

Legal Rights & Agreement Rules · Restriction or exception

Exclusion: losses claimed by the provider, amounts not insurable by law, and sanctions-law violations

The insurer will not pay for any loss claimed by the provider; any amount not insurable under applicable law; or any provision of coverage to the extent it would expose the Member or the provider to a violation of economic or trade sanctions, laws or regulations of the United States or of any other jurisdiction whose laws the insurer is legally obligated to comply with. These exclusions apply to all coverages under the policy, including the Case Management Service and Identity Theft Recovery coverages that the Schedule lists as included for this program.

Supporting quotations

Any loss claimed by the provider.

Any amount not insurable under applicable law.

Any provision of coverage under the policy to the extent that such provision would expose the Member or provider to a violation of economic or trade sanctions, laws or regulations of the United States of America or any other jurisdiction with whose laws we are legally obligated to comply.

Legal Rights & Agreement Rules · Restriction or exception

Policy conditions apply to all coverages; assignment of the policy needs the insurer's written consent

The Conditions section says the conditions apply to all coverages under the policy. Under the Assignment condition, assignment of the policy is not valid unless the insurer gives written consent.

Supporting quotations

The following conditions apply to all coverages under the policy:

Assignment

Assignment of the policy will not be valid unless we give our written consent.

Legal Rights & Agreement Rules · Company commitment

The insurer's obligations continue if a Member or the provider goes bankrupt or insolvent

The insurer's obligations under the policy are not relieved by the bankruptcy or insolvency of a Member or of the provider.

Supporting quotations

Bankruptcy

Our obligations under the policy will not be relieved by the bankruptcy or insolvency of a Member or provider.

Legal Rights & Agreement Rules · Restriction or exception

The policy is the whole agreement between provider and insurer; only the insurer's endorsement can change it

The policy contains all the agreements between the provider and the insurer about the insurance. The provider named in the Schedule is authorized to change the policy terms with the insurer's consent, and the terms can be waived or amended only by an endorsement the insurer issues as part of the policy. The provider is responsible for informing Members of any changes to the policy.

Supporting quotations

Changes

The policy contains all the agreements between the provider and us concerning the insurance afforded. The provider shown in the Schedule of this Summary of Benefits is authorized to make changes in the terms of the policy with our consent. The policy’s terms can be waived or amended only by endorsement issued by us and made a part of the policy. The provider is responsible for informing Members of any changes to the policy.

Not stated here

• The document does not say how the provider will inform Members of changes.

Legal Rights & Agreement Rules · Restriction or exception

No coverage for a Member who conceals facts, commits fraud or makes false statements about this insurance

The insurer does not provide coverage to a Member who, before or after a loss, has intentionally concealed or misrepresented any material fact or circumstance, engaged in fraudulent conduct, or made false statements relating to this insurance.

Supporting quotations

Concealment or Fraud

We do not provide coverage to a Member who, whether before or after a loss, has:

a. Intentionally concealed or misrepresented any material fact or circumstance;

b. Engaged in fraudulent conduct; or

c. Made false statements; relating to this insurance.

Legal Rights & Agreement Rules · Restriction or exception

Members must make every reasonable effort not to reveal that cyber extortion coverage exists

For Cyber Extortion coverage, Members must make every reasonable effort to avoid divulging the existence of that coverage.

Supporting quotations

Confidentiality

With respect to Cyber Extortion coverage, Members must make every reasonable effort to avoid divulging the existence of this coverage.

Qualifications & exceptions

• The Schedule card for this program lists Cyber Extortion as Not Included.

Legal Rights & Agreement Rules · Procedure

After a loss: give prompt notice and notify police, schools or card companies; prejudicial failure ends coverage duty

In case of a loss, the Member or the Member's representative must give the insurer prompt notice; notify the police if there has been a violation of the law; notify the police or a school administrator in a cyberbullying event; and notify the bank, credit card, electronic fund transfer card or access device company in a fraud event involving a bank card, credit card or check. If failure to comply with these duties is prejudicial to the insurer, the insurer has no duty to provide coverage under the policy. A school administrator is a principal, vice principal, headmaster or dean.

Supporting quotations

Duties After Loss

In case of a loss, the following duties must be performed either by the Member or the Member's representative. If failure to comply with these duties is prejudicial to us, we have no duty to provide coverage under the policy:

a. Give prompt notice to us;

b. Notify the police if there has been a violation of the law;

c. Notify the police or a school administrator in case of a cyberbullying event;

d. Notify the bank, credit card or electronic fund transfer card or access device company in case of a fraud event involving a bank card, credit card or check;

School administrator means a principal, vice principal, headmaster or dean.

Qualifications & exceptions

• The cyberbullying and card-fraud duties relate to coverages the Schedule card for this program lists as Not Included.

Not stated here

• The document does not say how to give notice to the insurer or what "prompt" means.

Legal Rights & Agreement Rules · Procedure

The insurer can require details within 30 days, a device inspection, and a sworn proof of loss within 60 days

The Member must cooperate with the insurer's investigation or settlement. Within 30 days after the insurer asks, the Member must provide a description of how, when and where the stolen identity event occurred; written reports of any service providers who took part in the investigation or response; written reports or correspondence to or from law enforcement or any governmental authority or agency or similar organization; and any additional information the insurer asks for that is relevant to its investigation. As reasonably required, the Member must permit the insurer or a third party it appoints to inspect and audit the computing device, connected home device and any records, with the insurer paying any additional expenses of this condition (which are in addition to, not part of, the Member Annual Aggregate Limit) if it approves them in advance. The Member must also send signed, sworn proof of loss with the information the insurer requests within 60 days after the request; the insurer will supply the forms.

Supporting quotations

e. Cooperate with us in the investigation or settlement as follows:

(1) Provide the following information within 30 days after our request:

(i) A description of how, when and where the stolen identity event occurred.

(ii) Written reports of any service providers who participated in the investigation of or response to the stolen identity event.

(iii) Written reports or correspondence to or from law enforcement or any governmental authority or agency, or similar organization.

(iv) Any additional information we request relevant to the investigation of the stolen identity event.

(2) As may be reasonably required, permit us or a third party appointed by us to inspect and audit the computing device, connected home device, and any records. Any additional expenses related to this Condition F.9.e.(2) will be paid by us and will be in addition to, and not part of, the Member Annual Aggregate Limit. We must approve such expenses in advance.

(3) Send us signed, sworn proof of loss that contains the information we request to investigate the stolen identity event. This must be done within 60 days after our request. We will supply the necessary forms.

Not stated here

• The document does not say what happens if these deadlines are missed beyond the prejudice rule in the introduction to the duties after loss.

Legal Rights & Agreement Rules · Restriction or exception

The insurer is not the Member's or provider's legal advisor, and its coverage decisions are not legal advice

The insurer states that it is not the legal advisor of the Members or the provider, and that its determination of what is or is not insured does not represent advice or counsel about what a Member should or should not do.

Supporting quotations

Legal Advice

We are not the Members' or provider’s legal advisor. Our determination of what is or is not insured under the policy does not represent advice or counsel from us about what a Member should or should not do.

Legal Rights & Agreement Rules · Procedure

Data breach condition: consult the insurer before notifying; alternate vendors need approval and are capped

Under coverage for notification of data breach affected individuals, the Member agrees to consult the insurer before notification is issued, and the insurer assumes no responsibility for services promised to affected individuals without its prior agreement. The insurer will suggest a service provider for the notification and services; if the Member prefers an alternate provider, the insurer must approve it and will pay no more than it would have paid using the suggested provider. At the pre-notification consultation the Member must give the insurer and the service provider information about the affected individuals to be notified including contact information, information about the data breach event that may appropriately be communicated, and the scope of services the Member wants for affected individuals (coverage may be structured with fewer services to reach more people within the limit).

Supporting quotations

Pre-Notification Consultation

a. The Member agrees to consult with us prior to the issuance of notification to affected individuals under coverage B.2.h. Data Breach. We assume no responsibility for any services promised to affected individuals without our prior agreement.

b. We will suggest a service provider for Notification to Affected Individuals and Services to Affected Individuals. If the Member prefers to use an alternate service provider, our coverage is subject to the following limitations:

(1) Such alternate service provider must be approved by us; and

(2) Our payment for services provided by any alternate service provider will not exceed the amount that we would have paid using the service provider we had suggested.

c. The Member will provide us and the service provider the following at our pre-notification consultation with the Member:

(1) Requested information about the affected individuals to be notified, including contact information;

(2) Information about the data breach event that may appropriately be communicated with affected individuals; and

(3) The scope of services that the Member desires for the affected individuals. For example, coverage may be structured to provide fewer services in order to make those services available to more affected individuals without exceeding the available limit of coverage.

Qualifications & exceptions

• The Schedule card for this program lists Data Breach as Not Included.

Legal Rights & Agreement Rules · Restriction or exception

Only services from insurer-approved providers are paid for; services are not guaranteed to work for everyone

The insurer pays only for services provided by service providers it has approved, and Members must get its prior approval for any provider whose expenses they want covered; it will not unreasonably withhold approval. Members have a direct relationship with service providers paid for in whole or in part under the policy, and those firms work for the Members. The effectiveness of the services depends on Members' cooperation and assistance. The insurer does not warrant or guarantee that services will be available or applicable to all individuals; for example, under Identity Theft Recovery, Members who are minors or foreign nationals may not have credit records that can be provided or monitored, and service in Canada will be different from service in the United States and Puerto Rico. It also does not warrant or guarantee that services will end or eliminate all problems associated with covered events.

Supporting quotations

Services

a. We will only pay under the policy for services that are provided by service providers approved by us. Members must obtain our prior approval for any service provider whose expenses they want covered under the policy. We will not unreasonably withhold such approval.

b. Members will have a direct relationship with service providers paid for in whole or in part under the policy. Those firms work for the Members.

c. With respect to any services provided by any service provider paid for in whole or in part under the policy:

(1) The effectiveness of such services depends on Members' cooperation and assistance.

(2) We do not warrant or guarantee that services will be available or applicable to all individuals. For example, under Identity Theft Recovery Coverage, Members who are minors or foreign nationals may not have credit records that can be provided or monitored. Service in Canada will be different from service in the United States and Puerto Rico.

(3) We do not warrant or guarantee that the services will end or eliminate all problems associated with the covered events.

Legal Rights & Agreement Rules · Restriction or exception

Suits against the insurer need full compliance with the policy and must start within two years of the loss

No action can be brought against the insurer unless there has been full compliance with all of the terms and conditions of the policy and the action is started within two years after the date of loss.

Supporting quotations

Suit Against Us

No action can be brought against us unless there has been full compliance with all of the terms and conditions of the policy and the action is started within two years after the date of loss.

Legal Rights & Agreement Rules · Restriction or exception

The insurer takes over a Member's rights to recover from others, to the extent it pays, and the Member must protect them

If a Member for whom the insurer makes a payment has rights to recover damages from another party, those rights are transferred to the insurer to the extent of its payment. The Member must do everything necessary to secure the insurer's rights and must do nothing after loss to impair them.

Supporting quotations

Transfer of Rights of Recovery Against Others to Us

If any Member for whom we make payment under the policy has rights to recover damages from another, those rights are transferred to us to the extent of our payment. The Member must do everything necessary to secure our rights and must do nothing after loss to impair them.

Legal Rights & Agreement Rules · Restriction or exception

Disputes are governed by Washington law; the Washington Insurance Commissioner is the insurer's agent for service

Any dispute arising out of or related to the policy, or about its application or interpretation, is governed by the laws of the state of Washington without applying conflict-of-laws principles. The insurer designates the Insurance Commissioner of Washington as its lawful attorney on whom lawful process may be served in a Washington action by or for the "Named Insured" or any beneficiary under the policy, and designates the Corporate Secretary of HSB Specialty Insurance Company, One State Street, Hartford, CT 06102, as the person to whom the Commissioner may mail the process.

Supporting quotations

Venue and Choice of Law

Any dispute arising out of or related to the policy, or with respect to the application of or the interpretation of the policy, shall be governed by the laws of the state of Washington, without giving effect to the principles of conflict of laws. We designate the Insurance Commissioner of Washington, pursuant to the laws of Washington, as our true and lawful attorney upon whom may be served any lawful process in any action, suit or proceeding instituted in the State of Washington, by, or on behalf of, the Named Insured or any beneficiary hereunder arising out of this Policy. We designate the Corporate Secretary of HSB Specialty Insurance Company, One State Street, Hartford, CT 06102 as the person whom the said officer is authorized to mail such process or true copy thereof.

Not stated here

• The document does not define "Named Insured" or say whether a Member is a Named Insured or a beneficiary.
• The document does not say where disputes must be filed beyond naming Washington law and the service-of-process designation.

Legal Rights & Agreement Rules · Restriction or exception

A waiver or change of a policy provision is valid only if the insurer makes it in writing

A change or waiver of a provision of the policy must be in writing by the insurer to be valid. The insurer's request for an appraisal or examination does not waive any of its rights.

Supporting quotations

A change or waiver of a provision of the policy must be in writing by us to be valid. Our request for an appraisal or examination will not waive any of our rights.

Not stated here

• The group policy itself is not supplied in this source, so this card cannot say which policy provisions a change or waiver could affect.