If we become aware of a personal data breach, we will investigate and take appropriate remedial steps. We'll notify the relevant supervisory authority (IMY) within 72 hours of becoming aware of the breach where it's likely to pose a risk to your rights and freedoms (as required by GDPR Article 33). We'll notify you without undue delay where the breach is likely to pose a high risk to your rights and freedoms (as required by GDPR Article 34). And we'll comply with any other breach notification obligations under applicable law.