Loading...
HomeMy WebLinkAbout2022-12-06; City Council; ; Agreements with EC America Inc., and Procore Technologies, Inc., for the implementation, licensing and subscription of the Procore Project Management Pro SoftwareCA Review CKM Meeting Date: Dec. 6, 2022 To: Mayor and City Council From: Scott Chadwick, City Manager Staff Contact: Greg MacLellan, Senior Business Systems Specialist greg.maclellan@carlsbadca.gov, 442-339-2327 Doug Kappel, Information Technology Manager doug.kappel@carlsbadca.gov, 442-339-2791 Subject: Agreements with EC America Inc., and Procore Technologies, Inc., for the implementation, licensing and subscription of the Procore Project Management Pro Software District: All Recommended Actions •Adopt a resolution authorizing the City Manager to execute supplemental terms and conditions with EC America Inc. for the implementation of the Procore Project Management Pro solution and licensing of Procore Pro for $119,688 for an initial one- year period, and to extend the agreement for four optional one-year periods, which are expected to be more than $100,000 each, for a total estimated agreement amount of $566,080 plus a $10,000 contingency for unexpected implementation costs. •Adopt a resolution authorizing the City Manager to execute a subscription and services agreement with Procore Technologies Inc. for an initial one-year period at no cost, and to extend the agreement for four optional one-year periods. Executive Summary The city does not own a project management system designed for construction projects. Instead, existing projects are managed by systems owned by the construction companies, which requires staff to be familiar with these multiple systems. Additionally, since the city does not own the license to these applications, the city has limited ability to extract data for centralized reporting or dashboard creation. The proposed agreements would provide the City of Carlsbad with a system that would enable staff to track all construction projects with a single tool, resulting in greater efficiency and ability for oversight. The City Council is being asked to approve these agreements because under Carlsbad Municipal Code Section 3.28.060 – Procurement of Professional Services and Services, City Council approval is required when the cost to the city for such services will be more than $100,000 per agreement year. Dec. 6, 2022 Item #5 Page 1 of 103 Discussion The city is working to standardize how projects are managed across all departments, applying tools that allow for visibility and transparency into project status and progression. As part of this effort, staff engaged a consultant to identify project management needs and requirements, and the consultant recommended having two systems: one tailored specifically for construction projects and a separate system for managing all other types of projects. Because of the unique nature of construction projects, a project management solution that is tailored to specifically manage these types of projects is needed. A single city-owned construction project management system would standardize project management processes and provide city leadership with greater visibility on the progress being made on Capital Improvement Program projects and other city projects. Construction projects are currently managed using a variety of software and tools, including Procore construction management software owned and managed by the city’s construction contractors. By not owning a construction project management system, the city is limited in its ability to provide project status and tracking information. The city’s need for its own project management solution tailored to construction projects was identified by consultant ClientFirst in the comprehensive assessment of project management system needs and requirements it completed in October 2021. Based on its market analysis, ClientFirst recommended implementing Procore construction project management software. Procore is recognized as the industry standard for project management of construction projects. With the Procore construction project management system, the Public Works and Parks & Recreation departments will be able to manage their Capital Improvement Program projects in a single system controlled by the city. Procore will be the standard construction project management tool for all phases of capital improvement construction projects, including design and construction. The city will provide access to construction contractors as needed. The benefits of this city-owned software include the ability to standardize construction processes and project files and to have a central location where the files are stored. Owning centralized construction project data will provide the city’s leadership with access to real time information on the status of ongoing projects in all departments. This project aligns with the goals and initiatives outlined in the Connected Carlsbad roadmap and action plan to:  • Pursue community wide digital transformation  • Build capacity for data-driven government1 The price of the proposed supplemental terms and conditions agreement with EC America comes through a cooperative purchasing agreement, in compliance with Carlsbad Municipal Code Section 3.28.100 – Cooperative Purchasing. Under Section 3.28.100, the Purchasing Officer has the authority to join with other public or quasi-public agencies in cooperative 1 Connected Carlsbad: An Inclusive City Innovation Roadmap is a plan to better harness information and communication technologies to increase efficiency, communication, transparency and the overall quality of government service. Dec. 6, 2022 Item #5 Page 2 of 103 purchasing plans to purchase goods or services by contract as determined by the Purchasing Officer to be in the city’s best interest. The Purchasing Officer may buy directly from a vendor at a price established by another public agency when the other agency has made its purchase in a competitive manner. The vendor for this purchase, EC America, is an authorized reseller and provides products and technology services under the California Multiple Award Schedules Agreement No. 3-18-70- 1448C contract. Options Staff provide the following options for the City Council’s consideration: 1. Adopt a resolution authorizing the City Manager to execute supplemental terms and conditions with EC America Inc. for professional services for the implementation of Procore Project Management Pro and an initial year of licensing of Procore for $119,688. Pros • Standardized construction project files in a central location owned by the city • Real time access to data on Capital Improvement Program projects and other city projects • Staff worked with a consultant to identify the Procore construction management system as the industry standard used by developers • Advances the city’s Connected Carlsbad goals • Sufficient funding is available for the agreement Cons • None identified 2. Do not adopt a resolution authorizing execution of an agreement with Procore Technologies for construction management software licensing and professional services. Pros • None identified Cons • Construction project management files will continue to be managed in various locations, including in systems owned by city contractors • Project status data will continue not to be available in real-time Staff recommend Option 1. Fiscal Analysis Total costs The total cost of the agreement with EC America for the implementation and potential five years of ongoing support, licensing, and hosting of the Procore Pro construction project management system is estimated to be $566,080. An additional contingency of $10,000 is also being included to cover unexpected implementation costs. Annual support, licensing, and hosting costs of Procore are based on the number of projects that are managed in the system. The cost of years two through five of the EC America agreement are estimates based on the anticipated number of Capital Improvement Program Dec. 6, 2022 Item #5 Page 3 of 103 projects that will occur during those years. The actual costs could be higher or lower than what is estimated on the table below. Project budget There is $500,000 budgeted in the Strategic Digital Transformation Program for the project using the Technology Investment Capital Fund as the funding source. This will leave an estimated $340,000 for a project management solution for all other city projects that are not construction related. Ongoing costs If the agreement for years 2 through 5 is approved, then a supplemental budget request for ongoing licensing and subscription costs will need to be included in the annual budget process for the Information Technology Department’s annual operating budget starting in fiscal year 2023-24. This increase would also be included in the Information Technology Department’s annual service charges to other city departments. Next Steps With the City Council’s approval, the city manager will execute agreements with EC America and Procore Technologies. Environmental Evaluation This action does not constitute a project within the meaning of the California Environmental Quality Act under California Public Resources Code Section 21065. It has no potential to cause either a direct physical change or a reasonably foreseeable indirect physical change in the environment. Public Notification This item was noticed in keeping with the state’s Ralph M. Brown Act and it was available for public viewing and review at least 72 hours before the scheduled meeting date. Pre-Project Year 1 Year 2 Year 3 Year 4 Year 5 Total EC America Agreement Software Licensing -$ 87,446$ 96,161$ 105,810$ 116,391$ 128,030$ 533,838$ Implementation Professional Services - 32,242 - - - - 32,242 Agreement total - 119,688 96,161 105,810 116,391 128,030 566,080 Other cost ClientFirst Consulting 29,990 - - - - - 29,990 Contingency - 10,000 - - - - 10,000 Total other cost 29,990 10,000 - - - - 39,990 Total cost 29,990$ 129,688$ 96,161$ 105,810$ 116,391$ 128,030$ 606,070$ Project cost 29,990$ 129,688$ -$ -$ -$ -$ 159,678$ Operational cost - - 96,161 105,810 116,391 128,030 446,392 Total cost 29,990$ 129,688$ 96,161$ 105,810$ 116,391$ 128,030$ 606,070$ Estimated annual operating budget required 96,161$ 105,810$ 116,391$ 128,030$ 446,392$ Dec. 6, 2022 Item #5 Page 4 of 103 Exhibits 1. City Council resolution on agreement with EC America Inc. 2. City Council resolution on agreement with Procore Technologies Inc. 3. Purchasing Officer’s memorandum Dec. 6, 2022 Item #5 Page 5 of 103 RESOLUTION NO. 2022-270 A RESOLUTION OF THE CITY COUNCIL OF THE CITY OF CARLSBAD, CALIFORNIA, AUTHORIZING THE CITY MANAGER TO EXECUTE A SUPPLEMENTAL TERMS AND CONDITIONS AGREEMENT WITH EC AMERICA, INC. FOR IMPLEMENTATION, LICENSING AND SUBSCRIPTION SERVICES FOR PROCORE PROJECT MANAGEMENT PRO SOFTWARE IN AN AMOUNT NOT TO EXCEED $119,687.95 FOR THE INITIAL TERM AND AUTHORIZING THE CITY MANAGER TO EXECUTE EXTENSIONS AND AMENDMENTS OVER $100,000 ANNUALLY, IF APPROPRIATE, FOR A TOTAL ESTIMATED AGREEMENT AMOUNT OF $566,080 PLUS A $10,000 CONTINGENCY FOR UNEXPECTED IMPLEMENTATION COSTS WHEREAS, the City Council of the City of Carlsbad, California has determined that the most effective way to operate and support the City of Carlsbad's project management requirements is with Procore Project Management Pro Software; and WHEREAS, the City of Carlsbad currently does not have a project management solution in place and Procore Project Management Pro Software will be the solution chosen from a citywide requirement gathering process; and WHEREAS, EC America, Inc. provides implementation, licensing and subscription services for Procore Project Management Pro Software under the California Multiple Award Schedules (CMAS) Agreement CMAS No. 3-18-70-1448C contract; and WHEREAS, under Carlsbad Municipal Code 3.28.100 -Cooperative Purchasing, the Purchasing Officer has the authority to join with other public agencies for the purchase of goods or services when it is in the best interest of the city; and WHEREAS, in order for the City of Carlsbad to use Procore Project Management Pro Software EC America will provide implementation, licensing and subscription services for the PM solution; and WHEREAS, the city manager will have the authority to execute the supplemental terms and conditions agreement with EC America for implementation, licensing and subscription services of Proco re Project Management Pro Software and, if appropriate, to execute extensions and amendments to the agreement over $100,000 annually for four one-year terms, for a total estimated agreement amount of $566,080 plus a $10,000 contingency; and WHEREAS, EC America will provide implementation, licensing and subscription services of Procore Project Management Pro Software; and Exhibit 1 Dec. 6, 2022 Item #5 Page 6 of 103 WHEREAS, funding is available in the Strategic Digital Transformation Investment Program {SDTIP) to fund this project and initial services; and WHEREAS, if the EC America agreement is extended for Years 2 through 5 the Information Technology Department's Annual Operating Budget will need to be increased starting in Fiscal Year 2023-24 for the annual on-going licensing and subscription cost. NOW, THEREFORE, BE IT RESOLVED by the City Council of the City of Carlsbad, California, as follows: 1. 2. That the above recitations are true and correct. That the supplemental terms and conditions agreement for implementation, licensing and subscription services of Procore Project Management Pro Software with EC America (Attachment A) is approved and the city manager is authorized to execute all required documents on behalf of the city including possible extension and amendments over $100,000 for four one-year terms, if appropriate, for a total estimated agreement amount of $566,080 plus a $10,000 contingency. 3.That the total for the implementation, licensing and subscription services with EC America, Inc. shall not exceed $119,687.95 for the initial term ending one year from the date the agreement is signed. 4.That the funding for the agreement is budgeted in the fiscal year 2022-23 SDTIP Project Portfolio Management Tool and Consulting. 5.That the extension of the agreement for Years 2 through 5 for the annual licensing and subscription services are subject to the approval of corresponding increases to the Information Technology Department's Annual Operating Budget. Dec. 6, 2022 Item #5 Page 7 of 103 PASSED, APPROVED AND ADOPTED at a Regular Meeting of the City Council of the City of Carlsbad on the 6th day of December, 2022, by the following vote, to wit: AYES: NAYS: ABSENT: Blackburn, Bhat-Patel, Acosta, Norby. None. Hall. fv for MATT HALL, Mayor FAVIOLA MEDINA, City Clerk Services Manager {SEAL) Dec. 6, 2022 Item #5 Page 8 of 103 l DocuSign Envelope ID: 655A9EA1-DD18-408F-BE56-459C78232724 Attachment A SUPPLEMENTAL TERMS & CONDITIONS to the CALIFORNIA MULTIPLE AWARD SCHEDULE (CMAS) CONTRACT #3-18-70-1448C These Supplemental Terms and Conditions to the CMAS Contract #3-18-70-1448C , ("Agreement") dated as of this 1i-1t---day of ~buf2022 is between EC America, Inc., having its principal office and place of business at 8444 Westpark Drive, Ste. 200, McLean, VA 22102, ("Contractor") and CITY OF CARLSBAD, a municipal corporation ("City"). The City is undertaking certain activities related to acquiring Information Technology Products, Solutions and Services and the City desires to engage the Contractor to provide work in connection with such undertakings of the City. RECITALS A. City requires information technology goods and professional services of an information technology firm that is experienced in information technology solutions. B. Contractor has the necessary experience in providing professional services and advice related to information technology solutions. C. Contractor has submitted a proposal to City and has affirmed its willingness and ability to perform such work. D. Contractor was awarded the attached CMAS #3-18-70-1448C, signed and dated by the State of California, pursuant to a competitive solicitation process (CMAS Contract). The CMAS Contract has been in effect since October 3, 2018. Now, therefore, in consideration recitals and the mutual covenants contained herein, the City and Contractor agree as follows: Unless expressly amended and/or superseded, the terms and conditions of this Agreement shall include, and expressly incorporate, all the terms and conditions of the CMAS Contract. The parties agree that, to the extent the terms in this Agreement contradict or are in any way inconsistent with any term in the CMAS Contract, the terms in this Agreement shall prevail. The following terms of the CMAS Contract are specifically modified solely for the purposes of this Agreement: 1. SCOPE OF WORK City retains Contractor to perform, and Contractor agrees to render those services that are defined in attached Exhibit "A," Scope of Work (Services), , which is incorporated by this reference in accordance with this Agreement's terms and conditions. To the extent any of the terms in any exhibit or attachment to this Agreement conflict, in whole or part, with the terms of this Agreement, the terms of this Agreement shall prevail. 2. STANDARD OF PERFORMANCE While performing the Services, Contractor will exercise the reasonable professional care and skill customarily exercised by reputable members of Contractor's profession practicing in the Dec.6,2022 Item #5 Page 9 of 103 DocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Metropolitan Southern California Area, and will use reasonable diligence and best judgment while exercising its professional skill and expertise. 3. TERM The term of this Agreement will be effective for a period of one (1) year from the date first above written. The City Manager may amend the Agreement to extend it for four (4) additional one (1) year periods or parts thereof. Extensions will be based upon a satisfactory review of Contractor's performance, City needs, and appropriation of funds by the City Council. 4. TIME IS OF THE ESSENCE Time is of the essence for each and every provision of this Agreement. s. COMPENSATION The total fee payable for the Services to be performed during the initial Agreement term will be one hundred nineteen thousand six hundred eighty-seven dollars and ninety-five cents ($119,687.95). No other compensation for the Services will be allowed except for items covered by subsequent amendments to this Agreement. Fees for subsequent renewal terms will be based on Contractor's then-current pricing and the City's estimated number of projects annually and approved by both parties. 6. STATUS OF CONTRACTOR Contractor will perform the Services in Contractor's own way as an independent contractor and in pursuit of Contractor's independent calling, and not as an employee of City. Contractor will be under control of City only as to the result to be accomplished, but will consult with City as necessary. The persons used by Contractor to provide services under this Agreement will not be considered employees of City for any purposes. The payment made to Contractor pursuant to the Agreement will be the full and complete compensation to which Contractor is entitled. City will not make any federal or state tax withholdings on behalf of Contractor or its agents, employees or subcontractors. City will not be required to pay any workers' compensation insurance or unemployment contributions on behalf of Contractor or its employees or subcontractors. Contractor agrees to indemnify City within thirty (30) days for any tax, retirement contribution, social security, overtime payment, unemployment payment or workers' compensation payment which City may be required to make on behalf of Contractor or any agent, employee, or subcontractor of Contractor for work done under this Agreement. At the City's election, City may deduct the indemnification amount from any balance owing to Contractor. 1. SUBCONTRACTING All Services performed under this Agreement will be performed by Contractor or its authorized subcontractors who have been identified to City and approved by City in advance, such approval not to be unreasonably withheld. Notwithstanding any delegation of Services, Contractor will remain primarily responsible for the performance of the Services. Nothing contained in this Agreement will create any contractual relationship between any subcontractor of Contractor and City. Contractor will be responsible for payment of subcontractors. Contractor will bind every subcontractor and every subcontractor of a subcontractor by the terms of this Agreement applicable to Contractor's work unless specifically noted to the contrary in the subcontract and approved in writing by City. Dec.6,2022 Item #5 Page 10 of 103 DocuSign Envelope ID: 655A9EA1-DD18-408F-BE56-459C78232724 a. OTHER CONTRACTORS The City reserves the right to employ other Contractors in connection with the Services. 9. INDEMNIFICATION Contractor agrees to provide indemnification to the City under the same terms and conditions specified in the CMAS Contract's General Provisions -Information Technology, including Paragraph 7, "Compliance with Statutes and Regulations"; Paragraph 26, "Limitation of Liability"; Paragraph 27, "Contractor's Liability for Injury to Persons or Damage to Property"; Paragraph 28, "Indemnification"; and Paragraph 43, "Patent, Copyright and Trade Secret Indemnity" as well as the CMAS Contract's State Model Cloud Computer Services Special Provisions, including Paragraph 7, "Compliance with Statutes and Regulations"; Paragraph 20 "Limitation of Liability"; Paragraph 21, "Indemnification"; and Paragraph 34, "Patent, Copyright and Trade Secret Indemnity." Exhibit "B". Any references to the State in these paragraphs shall be construed to be the City and any reference to State Department of General Services or State Department of Technology officers and employees shall be construed to be the City Manager or a designee. The parties expressly agree that any payment, attorney's fee, costs or expense City incurs or makes to or on behalf of an injured employee under the City's self-administered workers' compensation is included as a loss, expense or cost for the purposes of this section, and that this section will survive the expiration or early termination of this Agreement 10. NOTICES The name of the persons who are authorized to give written notice or to receive written notice on behalf of City and on behalf of Contractor under this Agreement. For City Name Title Maria Callander IT Director Department IT City of Carlsbad Address 1635 Faraday Ave Carlsbad, CA 92008 Phone No. 442.339.2454 For Contractor Name Tyler Waldrep Title Sales Operations Manager Address 8444 Westpark Drive, Suite 200 McLean, VA 22102 Phone No. 770-625-7632 Email tyler.waldrep@immixgroup.com Each party will notify the other immediately of any changes of address that would require any notice or delivery to be directed to another address. 11. CONFUCT Of INTEREST Contractor shall file a Conflict of Interest Statement with the City Clerk in accordance with the requirements of the City of Carlsbad Conflict of Interest Code. The Contractor shall report investments or interests in all categories. Yes DNo ~ 12. GENERAL COMPLIANCE WITH LAWS Contractor will keep fully informed of federal, state and local laws and ordinances and regulations Dec.6,2022 Item #5 Page 11 of 103 DocuSign Envelope ID: 655A9EA 1-0018-408F-BE56-459C7B232724 which in any manner affect those employed by Contractor, or in any way affect the performance of the Services by Contractor. Contractor will at all times observe and comply with these laws, ordinances, and regulations and will be responsible for the compliance of Contractor's services with all applicable laws, ordinances and regulations. Contractor will be aware of the requirements of the Immigration Reform and Control Act of 1986 and will comply with those requirements, including, but not limited to, verifying the eligibility for employment of all agents, employees, subcontractors and consultants whose services are required by this Agreement. 13. DISCRIMINATION AND HARASSMENT PBPHIBIJED Contractor will comply with all applicable local, state and federal laws and regulations prohibiting discrimination, harassment, retaliation or other unlawful employment practice. 14. TERMINAJION RESERVED. 1 s. COVENANTS AGAINST CONTINGENT FEES Contractor warrants that Contractor has not employed or retained any company or person, other than a bona fide employee working for Contractor, to solicit or secure this Agreement, and that Contractor has not paid or agreed to pay any company or person, other than a bona fide employee, any fee , commission , percentage, brokerage fee, gift, or any other consideration contingent upon, or resulting from, the award or making of this Agreement. For breach or violation of this warranty, City will have the right to annul this Agreement without liability, or, in its discretion, to deduct from the Agreement price or consideration, or otherwise recover, the full amount of the fee, commission, percentage, brokerage fees , gift, or contingent fee. 1s. CLAIMS AND LAWSUITS By signing this Agreement, Contractor agrees that any Agreement claim submitted to City must be asserted as part of the Agreement process as set forth in this Agreement and not in anticipation of litigation or in conjunction with litigation. Contractor acknowledges that if a false claim is submitted to City, it may be considered fraud and Contractor may be subject to criminal prosecution. Contractor acknowledges that California Government Code sections 12650 et seq., the False Claims Act applies to this Agreement and, provides for civil penalties where a person knowingly submits a false claim to a public entity. These provisions include false claims made with deliberate ignorance of the false information or in reckless disregard of the truth or falsity of information. If City seeks to recover penalties pursuant to the False Claims Act, it is entitled to recover its litigation costs, including attorney's fees. Contractor acknowledges that the filing of a false claim may subject Contractor to an administrative debarment proceeding as the result of which Contractor may be prevented to act as a Contractor on any public work or improvement for a period of up to five (5) years. Contractor acknowledges debarment by another jurisdiction is grounds for City to terminate this Agreement. 11. JURISDICTION AND VENUE Any action at law or in equity brought by either of the parties for the purpose of enforcing a right or rights provided for by this Agreement will be tried in a court of competent jurisdiction in the County of San Diego, State of California, and the parties waive all provisions of law providing for a change of venue in these proceedings to any other county. Dec.6,2022 Item #5 Page 12 of 103 DocuSign Envelope ID: 655A9EA1-DD18-408F-BE56-459C7B232724 1s. SUCCESSORS AND ASSIGNS It is mutually understood and agreed that this Agreement will be binding upon City and Contractor and their respective successors. Neither this Agreement nor any part of it nor any monies due or to become due under it may be assigned by Contractor without the prior consent of City, which shall not be unreasonably withheld. 19. INSURANCE Contractor will obtain and maintain for the duration of the Agreement and any and all amendments, insurance against claims for injuries to persons or damage to property which may arise out of or in connection with performance of the services by Contractor or Contractor's agents, representatives, employees or subcontractors. The insurance will be obtained from an insurance carrier admitted and authorized to do business in the State of California. The insurance carrier is required to have a current Best's Key Rating of not less than "A-:VII"; OR with a surplus line insurer on the State of California's List of Approved Surplus Line Insurers (LASLI) with a rating in the latest Best's Key Rating Guide of at least "A:X"; OR an alien non-admitted insurer listed by the National Association of Insurance Commissioners (NAIC) latest quarterly listings report. • Coverage and Limits. Contractor will maintain the types of coverage and minimum limits indicated below, unless the Risk Manager or City Manager approves a lower amount. These minimum amounts of coverage will not constitute any limitations or cap on Contractor's indemnification obligations under this Agreement. City, its officers, agents and employees make no representation that the limits of the insurance specified to be carried by Contractor pursuant to this Agreement are adequate to protect Contractor. If Contractor believes that any required insurance coverage is inadequate, Contractor will obtain such additional insurance coverage, as Contractor deems adequate, at Contractor's sole expense. The full limits available to the named insured shall also be available and applicable to the City as an additional insured. • Commercial General Liability (CGL) Insurance. Insurance written on an "occurrence" basis, including personal & advertising injury, with limits no less than $1,000,000 per occurrence. If a general aggregate limit applies, either the general aggregate limit shall apply separately to this project/location or the general aggregate limit shall be twice the required occurrence limit. • Automobile Liability. (if the use of an automobile is involved for Contractor's work for City). $1 ,000,000 combined single-limit per accident for bodily injury and property damage. • Workers' Compensation and Employer's Liability. Workers' Compensation limits as required by the California Labor Code. Workers' Compensation will not be required if Contractor has no employees and provides, to City's satisfaction, a declaration stating this. • Professional Liability. Errors and omissions liability appropriate to Contractor's profession with limits of not less than $1 ,000,000 per claim. Coverage must be maintained for a period of five years following the date of completion of the work. • Additional Provisions. Contractor will ensure that the policies of insurance required under this Agreement contain, or are endorsed to contain, the following provisions: Dec. 6,2022 Item #5 Page 13 of 103 DocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C78232724 • The City will be named as an additional insured on Commercial General Liability which shall provide primary coverage to the City. • Contractor will obtain occurrence coverage, excluding Professional Liability, which will be written as claims-made coverage. • This insurance will be in force during the life of the Agreement and any extensions of it and will not be canceled without thirty (30) days prior written notice to City sent by certified mail pursuant to the Notice provisions of this Agreement. Providing Certificates of Insurance and Endorsements. Prior to City's execution of this Agreement, Contractor will furnish certificates of insurance and endorsements to City. Failure to Maintain Coverage. If Contractor fails to maintain any of these insurance coverages, then City will have the option to declare Contractor in breach, or may purchase replacement insurance or pay the premiums that are due on existing policies in order to maintain the required coverages. Contractor is responsible for any payments made by City to obtain or maintain insurance and City may collect these payments from Contractor or deduct the amount paid from any sums due Contractor under this Agreement. Submission of Insurance Policies. City reserves the right to require, at any time, complete and certified copies of any or all required insurance policies and endorsements. 20. BUSINESS LICENSE Contractor will obtain and maintain a City of Carlsbad Business License for the term of the Agreement, as may be amended from time-to-time. 21 . ENTIRE AGREEMENT This Agreement, together with any other written document referred to or contemplated by it, along with the purchase order for this Agreement and its provisions, embody the entire Agreement and understanding between the parties relating to the subject matter of it. In case of conflict, the terms of the Agreement supersede the purchase order. Neither this Agreement nor any of its provisions may be amended, modified, waived or discharged except in a writing signed by both parties. Ill Ill Ill Ill Ill Ill Ill Dec. 6,2022 Item #5 Page 14 of 103 DocuSign Envelope ID: 655A9EA1-DD18-408F-BE56-459C78232724 22. AUTHORITY The individuals executing this Agreement and the instruments referenced in it on behalf of Contractor each represent and warrant that they have the legal power, right and actual authority to bind Contractor to the terms and conditions of this Agreement IN WITNESS HEREOF, THE PARTIES HERETO HAVE CAUSED THIS SUPPLEMENT TO THE CMAS CONTRACT TO BE EXECUTED AND INSTITUTED ON THE DATE FIRST ABOVE WRITTEN. CONTRACTOR By: t",)\1g~ fJls (sign here) Tamara Ells VP (print name/title) By: ~t1li M "" ~gn here) CIT. 0 CARLSBAD, a municipal co orati n of the State of California By: City Manager ATTEST: f FAVIOLA MEDINA Jeffrey El linport VP Legal corp. sec .City Clerk Services Manager ---------------(print name/title) APPROVED AS TO FORM: Cindie McMahon, City Attorney BY: {j,,.J;.t, k.. ~IA. City Attorney Dec. 6,2022 Item #5 Page 15 of 103 EXHIBIT “A” - SCOPE OF WORK • Quote Number: QUO-1333721-Q2V4C9 • Contracting vehicle: CMAS Contract • Term length: 12 months • ACV Cap (MM): $40M • Project Cap: 80 • List of Services Included: o Unlimited customer support, unlimited user licensing, unlimited storage in the cloud, dedicated implementation manager • Total Cost to City: $119,687.95 Item Part Number Contract Trans Type Product Description Qty Price Extended Price 1 1410-6 3-18-70-1448C SUB Project Management Pro: provides Project Overview, Documentation, and Communication Management tools, including Directory, Reports, Documents, Drawings, Photos, RFIs, Specifications, Submittals, and Punchlist. Pricing is maximum price for ACV from $25M -** TRUSTED PRODUCT ** 1 $42,716.04 $42,716.04 2 1480-6 3-18-70-1448C SUB Quality & Safety: provides Quality & Safety tools, including Incidents, Inspections, and Observations. Pricing is maximum price for ACV from $25M - $50M.** TRUSTED PRODUCT ** 1 $13,509.32 $13,509.32 3 1430-6 3-18-70-1448C SUB Project Financials: provides Financial Management tools, including Direct Costs, Change Events, Commitments, Change Orders, Prime Contract, and Budget. Pricing is maximum price for ACV from $25M - $50M.** TRUSTED PRODUCT ** 1 $17,859.82 $17,859.82 4 1600-6 3-18-70-1448C SUB Invoice Management: provides invoice management tools, including Owner and Subcontractor invoices. Pricing is maximum price for ACV from $25M - $50M.** TRUSTED PRODUCT ** 1 $5,197.06 $5,197.06 5 1660-03 3-18-70-1448C SUB Procore Analytics Single Daily: export Procore product data into a hosted SQL database and apply Analytics tools on 100+ ready made reports and dashboard to derive insights. Pricing is maximum price for ACV from $25M - $50M.** TRUSTED PRODUCT ** 1 $8,163.63 $8,163.63 6 PRO-2800 3-18-70-1448C XAAS Custom Statements of Work: One hour of custom bundle of services based on business needs. May include any of the above service types. If additional services not listed are needed, these requests will be evaluated on a case by case basis for feasibility. M** TRUSTED PRODUCT ** 156 $206.68 $32.242.08 SUBSCRIPTION $87,445.87 SERVICES $32,242.08 Grand Total $119,687.95 DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 16 of 103 QuickStart 4 Services Included: Implementation Manager Services. Up to 35 hours of Implementation Manager Services for 16 weeks, ensuring a consistent point of contact to drive implementation success metrics throughout the implementation. Includes weekly scheduled consultations and project administration. Onsite Training. Up to 2 days of onsite training, up to 8 hours per day, to increase adoption and accelerate time value. Consulting Services. 15 hours of additional 1:1 virtual Consulting services to assist with strategic business planning, education, deep product training, Procore rollout, and best practices for additional users. Custom Solutions. 25 hours with Contractor Custom Solution experts to design and implement custom forms, custom workflows, and custom tools. Add-On Services. Services in addition to those included in this service package, such as an extension of Implementation Manager services beyond (16) weeks, additional Consulting Services and Customer solution hours, or Training and Integration Services, are available upon request for a fee and are not included in this scope. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 17 of 103 GSPD-401IT-CMAS CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) GENERAL PROVISIONS – INFORMATION TECHNOLOGY REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 1 OF 61 1. DEFINITIONS: Unless otherwise specified in the Statement of Work the following terms shall be given the meaning shown, unless context requires otherwise. a) "Acceptance Tests" means those tests performed during the Performance Period which are intended to determine compliance of Equipment and Software with the specifications and all other Attachments incorporated herein by reference and to determine the reliability of the Equipment. b) "Application Program" means a computer program which is intended to be executed for the purpose of performing useful work for the user of the information being processed. Application programs are developed or otherwise acquired by the user of the Hardware/Software system, but they may be supplied by the Contractor. c) "Attachment" means a mechanical, electrical, or electronic interconnection to the Contractor- supplied Machine or System of Equipment, manufactured by other than the original Equipment manufacturer, that is not connected by the Contractor. d) “Business entity” means any individual, business, partnership, joint venture, corporation, S- corporation, limited liability company, sole proprietorship, joint stock company, consortium, or other private legal entity recognized by statute. e) “Buyer” means the State’s authorized contracting official. f) “Commercial Hardware” means Hardware developed or regularly used that: (i) has been sold, leased, or licensed to the general public; (ii) has been offered for sale, lease, or license to the general public; (iii) has not been offered, sold, leased, or licensed to the public but will be available for commercial sale, lease, or license in time to satisfy the delivery requirements of this Contract; or (iv) satisfies criterion expressed in (i), (ii), or (iii) above and would require only minor modifications to meet the requirements of this Contract. g) “Commercial Software” means Software developed or regularly used that: (i) has been sold, leased, or licensed to the general public; (ii) has been offered for sale, lease, or license to the general public; (iii) has not been offered, sold, leased, or licensed to the public but will be available for commercial sale, lease, or license in time to satisfy the delivery requirements of this Contract; or (iv) satisfies a criterion expressed in (i), (ii), or (iii) above and would require only minor modifications to meet the requirements of this Contract. h) “Contract” means this Contract or agreement (including any purchase order), by whatever name known or in whatever format used. i) “Custom Software” means Software that does not meet the definition of Commercial Software. j) “Contractor” means the Business Entity with whom the State enters into this Contract. Contractor shall be synonymous with “supplier”, “vendor” or other similar term. k) "Data Processing Subsystem" means a complement of Contractor-furnished individual Machines, including the necessary controlling elements (or the functional equivalent), Operating Software and Software, if any, which are acquired to operate as an integrated group, and which are interconnected entirely by Contractor- supplied power and/or signal cables; e.g., direct access controller and drives, a cluster of terminals with their controller, etc. l) "Data Processing System (System)" means the total complement of Contractor-furnished Machines, including one or more central processors (or instruction processors), Operating Software which are acquired to operate as an integrated group. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 18 of 103 GSPD-401IT-CMAS CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) GENERAL PROVISIONS – INFORMATION TECHNOLOGY REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 2 OF 61 m) “Deliverables” means Goods, Software, Information Technology, telecommunications technology, Hardware, and other items (e.g. reports) to be delivered pursuant to this Contract, including any such items furnished incident to the provision of services. n) "Designated CPU(s)" means for each product, if applicable, the central processing unit of the computers or the server unit, including any associated peripheral units. If no specific “Designated CPU(s)” are specified on the Contract, the term shall mean any and all CPUs located at the site specified therein. o) "Documentation" means manuals and other printed materials necessary or useful to the State in its use or maintenance of the Equipment or Software provided hereunder. Manuals and other printed materials customized for the State hereunder constitute Work Product if such materials are required by the Statement of Work. p) "Equipment" is an all-inclusive term which refers either to individual Machines or to a complete Data Processing System or subsystem, including its Hardware and Operating Software (if any). q) "Equipment Failure" is a malfunction in the Equipment, excluding all external factors, which prevents the accomplishment of the Equipment’s intended function(s). If microcode or Operating Software residing in the Equipment is necessary for the proper operation of the Equipment, a failure of such microcode or Operating Software which prevents the accomplishment of the Equipment’s intended functions shall be deemed to be an Equipment Failure. r) "Facility Readiness Date" means the date specified in the Statement of Work by which the State must have the site prepared and available for Equipment delivery and installation. s) “Goods” means all types of tangible personal property, including but not limited to materials, supplies, and Equipment (including computer and telecommunications Equipment). t) "Hardware" usually refers to computer Equipment and is contrasted with Software. See also Equipment. u) "Installation Date" means the date specified in the Statement of Work by which the Contractor must have the ordered Equipment ready (certified) for use by the State. v) "Information Technology" includes, but is not limited to, all electronic technology systems and services, automated information handling, System design and analysis, conversion of data, computer programming, information storage and retrieval, telecommunications which include voice, video, and data communications, requisite System controls, simulation, electronic commerce, and all related interactions between people and Machines. w) "Machine" means an individual unit of a Data Processing System or subsystem, separately identified by a type and/or model number, comprised of but not limited to mechanical, electro- mechanical, and electronic parts, microcode, and special features installed thereon and including any necessary Software, e.g., central processing unit, memory module, tape unit, card reader, etc. x) "Machine Alteration" means any change to a Contractor-supplied Machine which is not made by the Contractor, and which results in the Machine deviating from its physical, mechanical, electrical, or electronic (including microcode) design, whether or not additional devices or parts are employed in making such change. y) "Maintenance Diagnostic Routines" means the diagnostic programs customarily used by the Contractor to test Equipment for proper functioning and reliability. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 19 of 103 GSPD-401IT-CMAS CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) GENERAL PROVISIONS – INFORMATION TECHNOLOGY REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 3 OF 61 z) “Manufacturing Materials” means parts, tools, dies, jigs, fixtures, plans, drawings, and information produced or acquired, or rights acquired, specifically to fulfill obligations set forth herein. aa)"Mean Time Between Failure (MTBF)” means the average expected or observed time between consecutive failures in a System or component. bb)"Mean Time to Repair (MTTR)" means the average expected or observed time required to repair a System or component and return it to normal operation. cc) "Operating Software" means those routines, whether or not identified as Program Products, that reside in the Equipment and are required for the Equipment to perform its intended function(s), and which interface the operator, other Contractor-supplied programs, and user programs to the Equipment. dd)"Operational Use Time" means for performance measurement purposes, that time during which Equipment is in actual operation by the State. For maintenance Operational Use Time purposes, that time during which Equipment is in actual operation and is not synonymous with power on time. ee)"Period of Maintenance Coverage" means the period of time, as selected by the State, during which maintenance services are provided by the Contractor for a fixed monthly charge, as opposed to an hourly charge for services rendered. The Period of Maintenance Coverage consists of the Principal Period of Maintenance and any additional hours of coverage per day, and/or increased coverage for weekends and holidays. ff) "Preventive Maintenance" means that maintenance, performed on a scheduled basis by the Contractor, which is designed to keep the Equipment in proper operating condition. gg)"Principal Period of Maintenance" means any nine consecutive hours per day (usually between the hours of 7:00 a.m. and 6:00 p.m.) as selected by the State, including an official meal period not to exceed one hour, Monday through Friday, excluding holidays observed at the installation. hh)"Programming Aids" means Contractor- supplied programs and routines executable on the Contractor’s Equipment which assists a programmer in the development of applications including language processors, sorts, communications modules, data base management systems, and utility routines, (tape-to-disk routines, disk-to-print routines, etc.). ii) "Program Product" means programs, routines, subroutines, and related items which are proprietary to the Contractor and which are licensed to the State for its use, usually on the basis of separately stated charges and appropriate contractual provisions. jj) "Remedial Maintenance" means that maintenance performed by the Contractor which results from Equipment (including Operating Software) failure, and which is performed as required, i.e., on an unscheduled basis. kk) "Software" means an all-inclusive term which refers to any computer programs, routines, or subroutines supplied by the Contractor, including Operating Software, Programming Aids, Application Programs, and Program Products. ll) "Software Failure” means a malfunction in the Contractor-supplied Software, other than Operating Software, which prevents the accomplishment of work, even though the Equipment (including its Operating Software) may still be capable of operating properly. For Operating Software failure, see definition of Equipment Failure. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 20 of 103 GSPD-401IT-CMAS CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) GENERAL PROVISIONS – INFORMATION TECHNOLOGY REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 4 OF 61 mm) "State” means the government of the State of California, its employees and authorized representatives, including without limitation any department, agency, or other unit of the government of the State of California. nn)"System" means the complete collection of Hardware, Software and services as described in this Contract, integrated and functioning together, and performing in accordance with this Contract. oo)“U.S. Intellectual Property Rights” means intellectual property rights enforceable in the United States of America, including without limitation rights in trade secrets, copyrights, and U.S. patents. 2. CONTRACT FORMATION: If this Contract results from a Letter of Offer, then Contractor’s offer is deemed a firm offer and this Contract document is the State's acceptance of that offer. 3. COMPLETE INTEGRATION: This Contract, including any documents incorporated herein by express reference, is intended to be a complete integration and there are no prior or contemporaneous different or additional agreements pertaining to the subject matter of the Contract. 4. SEVERABILITY: The Contractor and the State agree that if any provision of this Contract is found to be illegal or unenforceable, such term or provision shall be deemed stricken and the remainder of the Contract shall remain in full force and effect. Either party having knowledge of such term or provision shall promptly inform the other of the presumed non-applicability of such provision. 5. INDEPENDENT CONTRACTOR: Contractor and the agents and employees of Contractor, in the performance of this Contract, shall act in an independent capacity and not as officers or employees or agents of the State. 6. APPLICABLE LAW: This Contract shall be governed by and shall be interpreted in accordance with the laws of the State of California; venue of any action brought with regard to this Contract shall be in Sacramento County, Sacramento, California. The United Nations Convention on Contracts for the International Sale of Goods shall not apply to this Contract. 7. COMPLIANCE WITH STATUTES AND REGULATIONS: a) The State and the Contractor warrants and certifies that in the performance of this Contract, it will comply with all applicable statutes, rules, regulations and orders of the United States and the State of California. The Contractor agrees to indemnify the State against any loss, cost, damage or liability by reason of the Contractor’s violation of this provision. b) The State will notify Contractor of any such claim in writing and tender the defense thereof within a reasonable time; and DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 21 of 103 GSPD-401IT-CMAS CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) GENERAL PROVISIONS – INFORMATION TECHNOLOGY REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 5 OF 61 c) The Contractor will have sole control of the defense of any action on such claim and all negotiations for its settlement or compromise; provided that (i) when substantial principles of government or public law are involved, when litigation might create precedent affecting future State operations or liability, or when involvement of the State is otherwise mandated by law, the State may participate in such action at its own expense with respect to attorneys’ fees and costs (but not liability); (ii) where a settlement would impose liability on the State, affect principles of California government or public law, or impact the authority of the State, the Department of General Services will have the right to approve or disapprove any settlement or compromise, which approval will not unreasonably be withheld or delayed; and (iii) the State will reasonably cooperate in the defense and in any related settlement negotiations. d) If this Contract is in excess of $554,000, it is subject to the requirements of the World Trade Organization (WTO) Government Procurement Agreement (GPA). e) To the extent that this Contract falls within the scope of Government Code Section 11135, Contractor hereby agrees to respond to and resolve any complaint brought to its attention, regarding accessibility of its products or services. 8. CONTRACTOR’S POWER AND AUTHORITY: The Contractor warrants that it has full power and authority to grant the rights herein granted and will hold the State harmless from and against any loss, cost, liability, and expense (including reasonable attorney fees) arising out of any breach of this warranty. Further, Contractor avers that it will not enter into any arrangement with any third party which might abridge any rights of the State under this Contract. a) The State will notify Contractor of any such claim in writing and tender the defense thereof within a reasonable time; and b) The Contractor will have sole control of the defense of any action on such claim and all negotiations for its settlement or compromise; provided that (i) when substantial principles of government or public law are involved, when litigation might create precedent affecting future State operations or liability, or when involvement of the State is otherwise mandated by law, the State may participate in such action at its own expense with respect to attorneys’ fees and costs (but not liability); (ii) where a settlement would impose liability on the State, affect principles of California government or public law, or impact the authority of the State, the Department of General Services will have the right to approve or disapprove any settlement or compromise, which approval will not unreasonably be withheld or delayed; and (iii) the State will reasonably cooperate in the defense and in any related settlement negotiations. 9. CMAS - ASSIGNMENT: a) This Contract shall not be assignable by the Contractor in whole or in part without the written consent of the State. The State’s consent shall not be unreasonably withheld or delayed. For the purpose of this paragraph, State will not unreasonably prohibit Contractor from freely assigning its right to payment, provided that Contractor remains responsible for its obligations hereunder. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 22 of 103 GSPD-401IT-CMAS CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) GENERAL PROVISIONS – INFORMATION TECHNOLOGY REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 6 OF 61 b) Should the State desire financing of the assets provided hereunder through the Golden State Financial Marketplace, the Contractor agrees to assign to a State-designated lender its right to receive payment from the State for the assets in exchange for payment by the lender of the cash purchase price for the assets. Upon notice to do so from the State-designated lender at any time prior to payment by the State for the assets, the Contractor will execute and deliver to the State-designated lender an assignment agreement and any additional documents necessary for the State selected financing plan. The State-designated lender will pay the Contractor according to the terms of the Contractor’s invoice upon acceptance of the assets by the State. 10. WAIVER OF RIGHTS: Any action or inaction by the State or the failure of the State on any occasion, to enforce any right or provision of the Contract, shall not be construed to be a waiver by the State of its rights hereunder and shall not prevent the State from enforcing such provision or right on any future occasion. The rights and remedies of the State herein are cumulative and are in addition to any other rights or remedies that the State may have at law or in equity. 11. CMAS - ORDER OF PRECEDENCE: In the event of any inconsistency between the articles, attachments, specifications or provisions which constitute this Contract, the following order of precedence shall apply: a) These General Provisions – Information Technology (In the instances provided herein where the paragraph begins: “Unless otherwise specified in the Statement of Work” provisions specified in the Statement of Work replacing these paragraphs shall take precedence over the paragraph referenced in these General Provisions); b) Contract form, i.e., Purchase Order STD 65, FiSCal contract/order, and any amendments thereto; c) Other Special Provisions; d) Federal GSA (or other multiple award contract) terms and conditions; e) Statement of work, including any specifications incorporated by reference herein; and f) All other attachments incorporated in the Contract by reference. 12. PACKING AND SHIPMENT: a) All Goods are to be packed in suitable containers for protection in shipment and storage, and in accordance with applicable specifications. Each container of a multiple container shipment shall be identified to: i. show the number of the container and the total number of containers in the shipment; and ii. the number of the container in which the packing sheet has been enclosed. b) All shipments by Contractor or its subcontractors must include packing sheets identifying: the State’s Contract number; item number; quantity and unit of measure; part number and description of the Goods shipped; and appropriate evidence of inspection, if required. Goods for different Contracts shall be listed on separate packing sheets. c) Shipments must be made as specified in this Contract, as it may be amended, or otherwise directed in writing by the State’s Transportation Management Unit within the Department of General Services, Procurement Division. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 23 of 103 GSPD-401IT-CMAS CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) GENERAL PROVISIONS – INFORMATION TECHNOLOGY REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 7 OF 61 13. TRANSPORTATION COSTS AND OTHER FEES OR EXPENSES: No charge for delivery, drayage, express, parcel post, packing, cartage, insurance, license fees, permits, cost of bonds, or for any other purpose will be paid by the State unless expressly included and itemized in the Contract. a) The Contractor must strictly follow Contract requirements regarding Free on Board (F.O.B.), freight terms and routing instructions. The State may permit use of an alternate carrier at no additional cost to the State with advance written authorization of the Buyer. b) If “prepay and add” is selected, supporting freight bills are required when over $50, unless an exact freight charge is approved by the Transportation Management Unit within the Department of General Services Procurement Division and a waiver is granted. c) On "F.O.B. Shipping Point" transactions, should any shipments under the Contract be received by the State in a damaged condition and any related freight loss and damage claims filed against the carrier or carriers be wholly or partially declined by the carrier or carriers with the inference that damage was the result of the act of the shipper such as inadequate packaging or loading or some inherent defect in the Equipment and/or material, Contractor, on request of the State, shall at Contractor's own expense assist the State in establishing carrier liability by supplying evidence that the Equipment and/or material was properly constructed, manufactured, packaged, and secured to withstand normal transportation conditions. 14. DELIVERY: The Contractor shall strictly adhere to the delivery and completion schedules specified in this Contract. Time, if stated as a number of days, shall mean calendar days unless otherwise specified. The quantities specified herein are the only quantities required. If the Contractor delivers in excess of the quantities specified herein, the State shall not be required to make any payment for the excess Deliverables and may return them to Contractor at Contractor’s expense or utilize any other rights available to the State at law or in equity. 15. SUBSTITUTIONS: Substitution of Deliverables may not be tendered without advance written consent of the Buyer. Contractor shall not use any specification in lieu of those contained in the Contract without written consent of the Buyer. 16. INSPECTION, ACCEPTANCE AND REJECTION: Unless otherwise specified in the Statement of Work: a) When acquiring Commercial Hardware or Commercial Software, the State shall rely on Contractor’s existing quality assurance system as a substitute for State inspection and testing. For all other acquisitions, Contractor and its subcontractors will provide and maintain a quality assurance system acceptable to the State covering Deliverables and services under this Contract and will tender to the State only those Deliverables that have been inspected and found to conform to this Contract’s requirements. The Contractor will keep records evidencing inspections and their result, and will make these records available to the State during Contract performance and for three years after final payment. The Contractor shall permit the State to review procedures, practices, processes, and related documents to determine the acceptability of Contractor’s quality assurance System or other similar business practices related to performance of the Contract. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 24 of 103 GSPD-401IT-CMAS CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) GENERAL PROVISIONS – INFORMATION TECHNOLOGY REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 8 OF 61 b) All Deliverables may be subject to inspection and test by the State or its authorized representatives. c) The Contractor and its subcontractors shall provide all reasonable facilities for the safety and convenience of inspectors at no additional cost to the State. The Contractor shall furnish to inspectors all information and data as may be reasonably required to perform their inspection. d) Subject to subsection 16 (a) above, all Deliverables may be subject to final inspection, test and acceptance by the State at destination, notwithstanding any payment or inspection at source. e) The State shall give written notice of rejection of Deliverables delivered or services performed hereunder within a reasonable time after receipt of such Deliverables or performance of such services. Such notice of rejection will state the respects in which the Deliverables do not substantially conform to their specifications. If the State does not provide such notice of rejection within 15 days of delivery for purchases of Commercial Hardware or Commercial Software or 30 days of delivery for all other purchases, such Deliverables and services will be deemed to have been accepted. Acceptance by the State will be final and irreversible, except as it relates to latent defects, fraud, and gross mistakes amounting to fraud. Acceptance shall not be construed to waive any warranty rights that the State might have at law or by express reservation in this Contract with respect to any nonconformity. 17. SAMPLES: a) Samples of items may be required by the State for inspection and specification testing and must be furnished free of expense to the State. The samples furnished must be identical in all respects to the products offered and/or specified in the Contract. b) Samples, if not destroyed by tests, may, upon request made at the time the sample is furnished, be returned at Contractor’s expense. 18. CMAS - WARRANTY: The following warranty language is in addition to the warranty language provided in the federal GSA Multiple Award Schedule or other base Contract used to establish this CMAS Contract. When there is a conflict between the language, the following warranty language overrides. a) Unless otherwise specified in the Statement of Work, the warranties in this subsection a) begin upon delivery of the goods or services in question and end 1 year thereafter. The Contractor warrants that (i) Deliverables and services furnished hereunder will substantially conform to the requirements of this Contract (including without limitation all descriptions, specifications, and drawings identified in the Statement of Work), and (ii) the Deliverables will be free from material defects in materials and workmanship. Where the parties have agreed to design specifications (such as a Detailed Design Document) and incorporated the same or equivalent in the Statement of Work directly or by reference, the Contractor will warrant that its Deliverables provide all material functionality required thereby. In addition to the other warranties set forth herein, where the Contract calls for delivery of Commercial Software, the Contractor warrants that such Software will perform in accordance with its license and accompanying Documentation. The State’s approval of designs or specifications furnished by Contractor shall not relieve the Contractor of its obligations under this warranty. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 25 of 103 GSPD-401IT-CMAS CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) GENERAL PROVISIONS – INFORMATION TECHNOLOGY REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 9 OF 61 b) The Contractor warrants that Deliverables furnished hereunder (i) will be free, at the time of delivery, of harmful code (i.e. computer viruses, worms, trap doors, time bombs, disabling code, or any similar malicious mechanism designed to interfere with the intended operation of, or cause damage to, computers, data, or Software); and (ii) will not infringe or violate any U.S. Intellectual Property Right. Without limiting the generality of the foregoing, if the State believes that harmful code may be present in any Commercial Software delivered hereunder, the Contractor will, upon the State’s request, provide a new or clean install of the Software. c) Unless otherwise specified in the Statement of Work: i. The Contractor does not warrant that any Software provided hereunder is error-free or that it will run without immaterial interruption. ii. The Contractor does not warrant and will have no responsibility for a claim to the extent that it arises directly from (A) a modification made by the State, unless such modification is approved or directed by the Contractor, (B) use of Software in combination with or on products other than as specified by Contractor, or (C) misuse by the State. iii. Where the Contractor resells Commercial Hardware or Commercial Software it purchased from a third party, Contractor, to the extent it is legally able to do so, will pass through an such third-party warranties to the State and will reasonably cooperate in enforcing them. Such warranty pass- through will not relieve the Contractor from Contractor’s warranty obligations set forth above. d) All warranties, including special warranties specified elsewhere herein, shall inure to the State, its successors, assigns, customer agencies, and governmental users of the Deliverables or services. e) Except as may be specifically provided in the Statement of Work or elsewhere in this Contract, for any breach of the warranties provided in this Section, the State’s exclusive remedy and Contractor’s sole obligation will be limited to: i. re-performance, repair, or replacement of the nonconforming Deliverable (including without limitation an infringing Deliverable) or service; or ii. should the State in its sole discretion consent, refund of all amounts paid by the State for the nonconforming Deliverable or service and payment to the State of any additional amounts necessary to equal the State’s Cost to Cover. “Cost to Cover” means the cost, properly mitigated, of procuring Deliverables or services of equivalent capability, function, and performance. The payment obligation in subsection e)(ii) above will not exceed the limits on Contractor’s liability set forth in the Section entitled “Limitation of Liability.” f) EXCEPT FOR THE EXPRESS WARRANTIES SPECIFIED IN THIS SECTION, CONTRACTOR MAKES NO WARRANTIES EITHER EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 19. SAFETY AND ACCIDENT PREVENTION: In performing work under this Contract on State premises, the Contractor shall conform to any specific safety requirements contained in the Contract or as required by law or regulation. The Contractor shall take any additional precautions as the State may reasonably require for safety and accident prevention purposes. Any violation of such rules and requirements, unless promptly corrected, shall be grounds for termination of this Contract in accordance with the default provisions hereof. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 26 of 103 GSPD-401IT-CMAS CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) GENERAL PROVISIONS – INFORMATION TECHNOLOGY REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 10 OF 61 20. INSURANCE: The Contractor shall maintain all commercial general liability insurance, workers’ compensation insurance and any other insurance required under the Contract. The Contractor shall furnish insurance certificate(s) evidencing required insurance coverage acceptable to the State, including endorsements showing the State as an “additional insured” if required under Contract. Any required endorsements requested by the State must be separately provided; merely referring to such coverage on the certificate(s) is insufficient for this purpose. When performing work on state owned or controlled property, Contractor shall provide a waiver of subrogation in favor of the State for its workers’ compensation policy. 21. TERMINATION FOR NON- APPROPRIATION OF FUNDS: a) If the term of this Contract extends into fiscal years subsequent to that in which it is approved, such continuation of the Contract is contingent on the appropriation of funds for such purpose by the Legislature. If funds to effect such continued payment are not appropriated, the Contractor agrees to take back any affected Deliverables furnished under this Contract, terminate any services supplied to the State under this Contract, and relieve the State of any further obligation therefor. b) The State agrees that if it appears likely that subsection a) above will be invoked, the State and Contractor shall agree to take all reasonable steps to prioritize work and Deliverables and minimize the incurrence of costs prior to the expiration of funding for this Contract. c) THE STATE AGREES THAT IF PARAGRAPH a) ABOVE IS INVOKED, COMMERCIAL HARDWARE AND SOFTWARE THAT HAS NOT BEEN PAID FOR, SHALL BE RETURNED TO THE CONTRACTOR IN SUBSTANTIALLY THE SAME CONDITION IN WHICH DELIVERED TO THE STATE, SUBJECT TO NORMAL WEAR AND TEAR. THE STATE FURTHER AGREES TO PAY FOR PACKING, CRATING, TRANSPORTATION TO CONTRACTOR’S NEAREST FACILITY AND FOR REIMBURSEMENT TO THE CONTRACTOR FOR EXPENSES INCURRED FOR THEIR ASSISTANCE IN SUCH PACKING AND CRATING. 22. TERMINATION FOR THE CONVENIENCE OF THE STATE: a) The State may terminate performance of work under this Contract for its convenience in whole or, from time to time, in part, if the Department of General Services, Deputy Director Procurement Division, or designee, determines that a termination is in the State’s interest. The Department of General Services, Deputy Director, Procurement Division, or designee, shall terminate by delivering to the Contractor a Notice of Termination specifying the extent of termination and the effective date thereof. b) After receipt of a Notice of Termination, and except as directed by the State, the Contractor shall immediately proceed with the following obligations, as applicable, regardless of any delay in determining or adjusting any amounts due under this clause. The Contractor shall: i. Stop work as specified in the Notice of Termination. ii. Place no further subcontracts for materials, services, or facilities, except as necessary to complete the continuing portion of the Contract. iii. Terminate all subcontracts to the extent they relate to the work terminated. iv. Settle all outstanding liabilities and termination settlement proposals arising from the termination of subcontracts; DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 27 of 103 GSPD-401IT-CMAS CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) GENERAL PROVISIONS – INFORMATION TECHNOLOGY REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 11 OF 61 c) After termination, the Contractor shall submit a final termination settlement proposal to the State in the form and with the information prescribed by the State. The Contractor shall submit the proposal promptly, but no later than 90 days after the effective date of termination, unless a different time is provided in the Statement of Work or in the Notice of Termination. d) The Contractor and the State may agree upon the whole or any part of the amount to be paid as requested under subsection (c) above. e) Unless otherwise set forth in the Statement of Work, if the Contractor and the State fail to agree on the amount to be paid because of the termination for convenience, the State will pay the Contractor the following amounts; provided that in no event will total payments exceed the amount payable to the Contractor if the Contract had been fully performed: i. The Contract price for Deliverables or services accepted or retained by the State and not previously paid for, adjusted for any savings on freight and other charges; and ii. The total of: A) The reasonable costs incurred in the performance of the work terminated, including initial costs and preparatory expenses allocable thereto, but excluding any cost attributable to Deliverables or services paid or to be paid; B) The reasonable cost of settling and paying termination settlement proposals under terminated subcontracts that are properly chargeable to the terminated portion of the Contract; and C) Reasonable storage, transportation, demobilization, unamortized overhead and capital costs, and other costs reasonably incurred by the Contractor in winding down and terminating its work. f) The Contractor will use generally accepted accounting principles, or accounting principles otherwise agreed to in writing by the parties, and sound business practices in determining all costs claimed, agreed to, or determined under this clause. 23. TERMINATION FOR DEFAULT: a) The State may, subject to the clause titled “Force Majeure” and to subsection d) below, by written notice of default to the Contractor, terminate this Contract in whole or in part if the Contractor fails to: i. Deliver the Deliverables or perform the services within the time specified in the Contract or any amendment thereto; ii. Make progress, so that the lack of progress endangers performance of this Contract; or iii. Perform any of the other provisions of this Contract. b) The State’s right to terminate this Contract under subsection a) above, may be exercised only if the failure constitutes a material breach of this Contract and if the Contractor does not cure such failure within the time frame stated in the State’s cure notice, which in no event will be less than 15 days, unless the Statement of Work calls for a different period. c) If the State terminates this Contract in whole or in part pursuant to this Section, it may acquire, under terms and in the manner the Buyer considers appropriate, Deliverables or services similar to those terminated, and the Contractor will be liable to the State for any excess costs for those Deliverables and services, including without limitation costs third party vendors charge for Manufacturing Materials (but subject to the clause entitled “Limitation of Liability”). However, the Contractor shall continue the work not terminated. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 28 of 103 GSPD-401IT-CMAS CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) GENERAL PROVISIONS – INFORMATION TECHNOLOGY REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 12 OF 61 d) If the Contract is terminated for default, the State may require the Contractor to transfer title, or in the case of licensed Software, license, and deliver to the State, as directed by the Buyer, any: i. completed Deliverables, ii. partially completed Deliverables, and, iii. subject to provisions of subsection e) below, Manufacturing Materials related to the terminated portion of this Contract. Nothing in this subsection d) will be construed to grant the State rights to Deliverables that it would not have received had this Contract been fully performed. Upon direction of the Buyer, the Contractor shall also protect and preserve property in its possession in which the State has an interest. e) The State shall pay Contract price for completed Deliverables delivered and accepted and items the State requires the Contractor to transfer under section (d) above. Unless the Statement of Work calls for different procedures or requires no- charge delivery of materials, the Contractor and Buyer shall attempt to agree on the amount of payment for Manufacturing Materials and other materials delivered and accepted by the State for the protection and preservation of the property; provided that where the Contractor has billed the State for any such materials, no additional charge will apply. Failure to agree will constitute a dispute under the Disputes clause. The State may withhold from these amounts any sum it determines to be necessary to protect the State against loss because of outstanding liens or claims of former lien holders. f) If, after termination, it is determined by a final decision that the Contractor was not in default, the rights and obligations of the parties shall be the same as if the termination had been issued for the convenience of the State. g) Both parties, State and Contractor, upon any termination for default, have a duty to mitigate the damages suffered by it. h) The rights and remedies of the State in this clause are in addition to any other rights and remedies provided by law or under this Contract, and are subject to the clause titled “Limitation of Liability.” 24. FORCE MAJEURE: Except for defaults of subcontractors at any tier, the Contractor shall not be liable for any excess costs if the failure to perform the Contract arises from causes beyond the control and without the fault or negligence of the Contractor. Examples of such causes include, but are not limited to: a) Acts of God or of the public enemy, and b) Acts of the federal or State government in either its sovereign or contractual capacity. If the failure to perform is caused by the default of a subcontractor at any tier, and if the cause of the default is beyond the control of both the Contractor and subcontractor, and without the fault or negligence of either, the Contractor shall not be liable for any excess costs for failure to perform. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 29 of 103 GSPD-401IT-CMAS CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) GENERAL PROVISIONS – INFORMATION TECHNOLOGY REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 13 OF 61 25. RIGHTS AND REMEDIES OF STATE FOR DEFAULT: a) In the event any Deliverables furnished or services provided by the Contractor in the performance of the Contract should fail to conform to the requirements herein, or to the sample submitted by the Contractor, the State may reject the same, and it shall become the duty of the Contractor to reclaim and remove the item promptly or to correct the performance of services, without expense to the State, and immediately replace all such rejected items with others conforming to the Contract. b) In addition to any other rights and remedies the State may have, the State may require the Contractor, at Contractor’s expense, to ship Deliverables via air freight or expedited routing to avoid or minimize actual or potential delay if the delay is the fault of the Contractor. c) In the event of the termination of the Contract, either in whole or in part, by reason of default or breach by the Contractor, any loss or damage sustained by the State in procuring any items which the Contractor agreed to supply shall be borne and paid for by the Contractor (but subject to the clause entitled “Limitation of Liability”). d) The State reserves the right to offset the reasonable cost of all damages caused to the State against any outstanding invoices or amounts owed to Contractor or to make a claim against the Contractor therefore. 26. LIMITATION OF LIABILITY: a) Except as may be otherwise approved by the Department of General Services Deputy Director, Procurement Division or their designee, Contractor’s liability for damages to the State for any cause whatsoever, and regardless of the form of action, whether in Contract or in tort, shall be limited to the Purchase Price. For purposes of this subsection a), “Purchase Price” will mean the aggregate Contract price; except that, with respect to a Contract under which multiple purchase orders will be issued (e.g., a Master Agreement or Multiple Award Schedule Contract), “Purchase Price” will mean the total price of the purchase order for the Deliverable(s) or service(s) that gave rise to the loss, such that Contractor will have a separate limitation of liability for each purchase order. b) The foregoing limitation of liability shall not apply (i) to any liability under the General Provisions entitled “Compliance with Statutes and Regulations”; (ii) to liability under the General Provisions entitled “Patent, Copyright, and Trade Secret Indemnity” or to any other liability (including without limitation indemnification obligations) for infringement of third party intellectual property rights; (iii) to claims arising under provisions herein calling for indemnification for third party claims against the State for death, bodily injury to persons or damage to real or tangible personal property caused by Contractor’s negligence or willful misconduct; or (iv) to costs or attorney’s fees that the State becomes entitled to recover as a prevailing party in any action. c) The State’s liability for damages for any cause whatsoever, and regardless of the form of action, whether in Contract or in tort, shall be limited to the Purchase Price, as that term is defined in subsection a) above. Nothing herein shall be construed to waive or limit the State’s sovereign immunity or any other immunity from suit provided by law. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 30 of 103 GSPD-401IT-CMAS CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) GENERAL PROVISIONS – INFORMATION TECHNOLOGY REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 14 OF 61 d) In no event will either the Contractor or the State be liable for consequential, incidental, indirect, special, or punitive damages, even if notification has been given as to the possibility of such damages, except (i) to the extent that Contractor’s liability for such damages is specifically set forth in the Statement of Work or (ii) to the extent that Contractor’s liability for such damages arises out of subsection b)(i), b)(ii), or b)(iv) above. 27. CONTRACTOR’S LIABILITY FOR INJURY TO PERSONS OR DAMAGE TO PROPERTY: a) The Contractor shall be liable for damages arising out of injury to the person and/or damage to the property of the State, employees of the State, persons designated by the State for training, or any other person(s) other than agents or employees of the Contractor, designated by the State for any purpose, prior to, during, or subsequent to delivery, installation, acceptance, and use of the Deliverables either at the Contractor’s site or at the State’s place of business, provided that the injury or damage was caused by the fault or negligence of the Contractor. b) The Contractor shall not be liable for damages arising out of or caused by an alteration or an Attachment not made or installed by the Contractor, or for damage to alterations or Attachments that may result from the normal operation and maintenance of the Deliverables provided by the Contractor during the Contract. 28. INDEMNIFICATION: The Contractor agrees to indemnify, defend and save harmless the State, its officers, agents and employees from any and all third party claims, costs (including without limitation reasonable attorneys’ fees), and losses due to the injury or death of any individual, or the loss or damage to any real or tangible personal property, resulting from the willful misconduct or negligent acts or omissions of the Contractor or any of its affiliates, agents, subcontractors, employees, suppliers, or laborers furnishing or supplying work, services, materials, or supplies in connection with the performance of this Contract. Such defense and payment will be conditional upon the following: a) The State will notify the Contractor of any such claim in writing and tender the defense thereof within a reasonable time; and b) The Contractor will have sole control of the defense of any action on such claim and all negotiations for its settlement or compromise; provided that (i) when substantial principles of government or public law are involved, when litigation might create precedent affecting future State operations or liability, or when involvement of the State is otherwise mandated by law, the State may participate in such action at its own expense with respect to attorneys’ fees and costs (but not liability); (ii) where a settlement would impose liability on the State, affect principles of California government or public law, or impact the authority of the State, the Department of General Services will have the right to approve or disapprove any settlement or compromise, which approval will not unreasonably be withheld or delayed; and (ii) the State will reasonably cooperate in the defense and in any related settlement negotiations. 29. INVOICES: Unless otherwise specified, invoices shall be sent to the address set forth herein. Invoices shall be submitted in triplicate and shall include the Contract number; release order number (if applicable); item number; unit price, extended item price and invoice total amount. State sales tax and/or use tax shall be itemized separately and added to each invoice as applicable. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 31 of 103 GSPD-401IT-CMAS CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) GENERAL PROVISIONS – INFORMATION TECHNOLOGY REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 15 OF 61 30. REQUIRED PAYMENT DATE: Payment will be made in accordance with the provisions of the California Prompt Payment Act, Government Code Section 927 et. seq. Unless expressly exempted by statute, the Act requires State agencies to pay properly submitted, undisputed invoices not more than 45 days after (i) the date of acceptance of Deliverables or performance of services; or (ii) receipt of an undisputed invoice, whichever is later. 31. TAXES: Unless otherwise required by law, the State of California is exempt from Federal excise taxes. The State will only pay for any State or local sales or use taxes on the services rendered or Goods supplied to the State pursuant to this Contract. 32. NEWLY MANUFACTURED GOODS: All Goods furnished under this Contract shall be newly manufactured Goods or certified as new and warranted as new by the manufacturer; used or reconditioned Goods are prohibited, unless otherwise specified. 33. CONTRACT MODIFICATION: No amendment or variation of the terms of this Contract shall be valid unless made in writing, signed by the parties and approved as required. No oral understanding or agreement not incorporated in the Contract is binding on any of the parties. 34. CONFIDENTIALITY OF DATA: All financial, statistical, personal, technical and other data and information relating to the State's operation which are designated confidential by the State and made available to the Contractor in order to carry out this Contract, or which become available to the Contractor in carrying out this Contract, shall be protected by the Contractor from unauthorized use and disclosure through the observance of the same or more effective procedural requirements as are applicable to the State. The identification of all such confidential data and information as well as the State's procedural requirements for protection of such data and information from unauthorized use and disclosure shall be provided by the State in writing to the Contractor. If the methods and procedures employed by the Contractor for the protection of the Contractor's data and information are deemed by the State to be adequate for the protection of the State's confidential information, such methods and procedures may be used, with the written consent of the State, to carry out the intent of this paragraph. The Contractor shall not be required under the provisions of this paragraph to keep confidential any data or information which is or becomes publicly available, is already rightfully in the Contractor's possession without obligation of confidentiality, is independently developed by the Contractor outside the scope of this Contract, or is rightfully obtained from third parties. 35. NEWS RELEASES: Unless otherwise exempted, news releases, endorsements, advertising, and social media content pertaining to this Contract shall not be made without prior written approval of the Department of General Services. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 32 of 103 GSPD-401IT-CMAS CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) GENERAL PROVISIONS – INFORMATION TECHNOLOGY REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 16 OF 61 36. DOCUMENTATION a) The Contractor agrees to provide to the State, at no charge, all Documentation as described within the Statement of Work, and updated versions thereof, which are necessary or useful to the State in its use of the Equipment or Software provided hereunder. The Contractor agrees to provide additional Documentation at prices not in excess of charges made by the Contractor to its other customers for similar Documentation. b) If the Contractor is unable to perform maintenance or the State desires to perform its own maintenance on Equipment purchased under this Contract then upon written notice by the State the Contractor will provide at Contractor’s then current rates and fees adequate and reasonable assistance including relevant Documentation to allow the State to maintain the Equipment based on Contractor’s methodology. The Contractor agrees that the State may reproduce such Documentation for its own use in maintaining the Equipment. If the Contractor is unable to perform maintenance, the Contractor agrees to license any other Contractor that the State may have hired to maintain the Equipment to use the above noted Documentation. The State agrees to include the Contractor’s copyright notice on any such Documentation reproduced, in accordance with copyright instructions to be provided by the Contractor. 37. RIGHTS IN WORK PRODUCT: a) All inventions, discoveries, intellectual property, technical communications and records originated or prepared by the Contractor pursuant to this Contract including papers, reports, charts, computer programs, and other Documentation or improvements thereto, and including Contractor’s administrative communications and records relating to this Contract (collectively, the “Work Product”), shall be Contractor’s exclusive property. The provisions of this subsection a) may be revised in a Statement of Work. b) Software and other materials developed or otherwise obtained by or for Contractor or its affiliates independently of this Contract or applicable purchase order (“Pre- Existing Materials”) do not constitute Work Product. If the Contractor creates derivative works of Pre-Existing Materials, the elements of such derivative works created pursuant to this Contract constitute Work Product, but other elements do not. Nothing in this Section 37 will be construed to interfere with Contractor’s or its affiliates’ ownership of Pre-Existing Materials. c) The State will have Government Purpose Rights to the Work Product as Deliverable or delivered to the State hereunder. “Government Purpose Rights” are the unlimited, irrevocable, worldwide, perpetual, royalty-free, non-exclusive rights and licenses to use, modify, reproduce, perform, release, display, create derivative works from, and disclose the Work Product. “Government Purpose Rights” also include the right to release or disclose the Work Product outside the State for any State government purpose and to authorize recipients to use, modify, reproduce, perform, release, display, create derivative works from, and disclose the Work Product for any State government purpose. Such recipients of the Work Product may include, without limitation, State Contractors, California local governments, the U.S. federal government, and the State and local governments of other states. “Government Purpose Rights” do not include any rights to use, modify, reproduce, perform, release, display, create derivative works from, or disclose the Work Product for any commercial purpose. d) The ideas, concepts, know-how, or techniques relating to data processing, developed during the course of this Contract by the Contractor or jointly by the Contractor and the State may be used by either party without obligation of notice or accounting. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 33 of 103 GSPD-401IT-CMAS CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) GENERAL PROVISIONS – INFORMATION TECHNOLOGY REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 17 OF 61 e) This Contract shall not preclude the Contractor from developing materials outside this Contract that are competitive, irrespective of their similarity to materials which might be delivered to the State pursuant to this Contract. 38. SOFTWARE LICENSE: Unless otherwise specified in the Statement of Work, the Contractor hereby grants to the State and the State accepts from the Contractor, subject to the terms and conditions of this Contract, a perpetual, irrevocable, royalty-free, non-exclusive, license to use the Software Products in this Contract (hereinafter referred to as “Software Products”). a) The State may use the Software Products in the conduct of its own business, and any division thereof b) The license granted above authorized the State to use the Software Products in machine- readable form on the Computer System located at the site(s) specified in the Statement of Work. Said Computer System and its associated units (collectively referred to as CPU) are as designated in the Statement of Work. If the designated CPU is inoperative due to malfunction, the license herein granted shall be temporarily extended to authorize the State to use the Software Products, in machined-readable form, on any other State CPU until the designated CPU is returned to operation. c) By prior written notice, the State may redesignate the CPU in which the Software Products are to be used provided that the redesignated CPU is substantially similar in size and scale at no additional cost. The redesignation shall not be limited to the original site and will be effective upon the date specified in the notice of redesignation. d) Acceptance of Commercial Software (including third party Software) and Custom Software will be governed by the terms and conditions of this Contract. 39. PROTECTION OF PROPRIETARY SOFTWARE AND OTHER PROPRIETARY DATA: The State agrees that all material appropriately marked or identified in writing as proprietary and furnished hereunder are provided for State’s exclusive use for the purposes of this Contract only. All such proprietary data shall remain the property of the Contractor. The State agrees to take all reasonable steps to insure that such proprietary data are not disclosed to others, without prior written consent of the Contractor, subject to the California Public Records Act. The State will insure, prior to disposing of any media, that any licensed materials contained thereon have been erased or otherwise destroyed. The State agrees that it will take appropriate action by instruction, agreement or otherwise with its employees or other persons permitted access to licensed software and other proprietary data to satisfy its obligations under this Contract with respect to use, copying, modification, protection and security of proprietary software and other proprietary data. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 34 of 103 GSPD-401IT-CMAS CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) GENERAL PROVISIONS – INFORMATION TECHNOLOGY REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 18 OF 61 40. RIGHT TO COPY OR MODIFY: a) Any Software Product provided by the Contractor in machine-readable form may be copied, in whole or in part, in printed or machine-readable form for use by the State with the designated CPU, to perform one-time benchmark tests, for archival or emergency restart purposes, to replace a worn copy, to understand the contents of such machine-readable material, or to modify the Software Product as provided below; provided, however, that no more than the number of printed copies and machine-readable copies as specified in the Statement of Work will be in existence under this Contract at any time without prior consent of the Contractor. Such consent shall not be unreasonably withheld by the Contractor. The original, and any copies of the Software Product, in whole or in part, which are made hereunder shall be the property of the Contractor. b) The State may modify any non-personal computer Software Product, in machine- readable form, for its own use and merge it into other program material. Any portion of the Software Product included in any merged program material shall be used only on the designated CPUs and shall be subject to the terms and conditions of the Contract. 41. FUTURE RELEASES: Unless otherwise specifically provided in the Contract, or the Statement of Work, if improved versions, e.g., patches, bug fixes, updates or releases, of any Software Product are developed by the contractor, and are made available to other licensees, they will be made available to the State at no additional cost only if such are made available to other licensees at no additional cost. If the Contractor offers new versions or upgrades to the Software Product, they shall be made available to the State at the State’s option at a price not greater than the Contract price plus a price increase proportionate to the increase from the list price of the original version to that of the new version, if any. If the Software Product has no list price, such price increase will be proportionate to the increase in average price from the original to the new version, if any, as estimated by the Contractor in good faith. 42. ENCRYPTION/CPU ID AUTHORIZATION CODES: a) When Encryption/CPU Identification (ID) authorization codes are required to operate the Software Products, the Contractor will provide all codes to the State with delivery of the Software. b) In case of an inoperative CPI, the Contractor will provide a temporary encryption/CPU ID authorization code to the State for use on a temporarily authorized CPU until the designated CPU is returned to operation. c) When changes in designated CPUs occur, the State will notify the Contractor via telephone and/or facsimile/e-mail of such change. Upon receipt of such notice, the Contractor will issue via telephone and/or facsimile/e-mail to the State within 24 hours, a temporary encryption ID authorization code for use on the newly designated CPU until such time as permanent code is assigned. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 35 of 103 GSPD-401IT-CMAS CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) GENERAL PROVISIONS – INFORMATION TECHNOLOGY REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 19 OF 61 43. PATENT, COPYRIGHT AND TRADE SECRET INDEMNITY: a) Contractor will indemnify, defend, and save harmless the State, its officers, agents, and employees, from any and all third-party claims, costs (including without limitation reasonable attorneys’ fees), and losses for infringement or violation of any U.S. Intellectual Property Right by any product or service provided hereunder. With respect to claims arising from computer Hardware or Software manufactured by a third party and sold by Contractor as a reseller, Contractor will pass through to the State such indemnity rights as it receives from such third party (“Third Party Obligation”) and will cooperate in enforcing them; provided that if the third party manufacturer fails to honor the Third Party Obligation, Contractor will provide the State with indemnity protection equal to that called for by the Third Party Obligation, but in no event greater than that called for in the first sentence of this Section. The provisions of the preceding sentence apply only to third party computer Hardware or Software sold as a distinct unit and accepted by the State. Unless a Third-Party Obligation provides otherwise, the defense and payment obligations set forth in this Section will be conditional upon the following: i. The State will notify the Contractor of any such claim in writing and tender the defense thereof within a reasonable time; and ii. The Contractor will have sole control of the defense of any action on such claim and all negotiations for its settlement or compromise; provided that (a) when substantial principles of government or public law are involved, when litigation might create precedent affecting future State operations or liability, or when involvement of the State is otherwise mandated by law, the State may participate in such action at its own expense with respect to attorneys’ fees and costs (but not liability); (b) where a settlement would impose liability on the State, affect principles of California government or public law, or impact the authority of the State, the Department of General Services will have the right to approve or disapprove any settlement or compromise, which approval will not unreasonably be withheld or delayed; and (c) the State will reasonably cooperate in the defense and in any related settlement negotiations. b) Should the Deliverables, or the operation thereof, become, or in the Contractor's opinion are likely to become, the subject of a claim of infringement or violation of a U.S. Intellectual Property Right, the State shall permit the Contractor at its option and expense either to procure for the State the right to continue using the Deliverables, or to replace or modify the same so that they become non-infringing. If none of these options can reasonably be taken, or if the use of such Deliverables by the State shall be prevented by injunction, the Contractor agrees to take back such Deliverables and make every reasonable effort to assist the State in procuring substitute Deliverables. If, in the sole opinion of the State, the return of such infringing Deliverables makes the retention of other Deliverables acquired from the Contractor under this Contract impractical, the State shall then have the option of terminating such Contracts, or applicable portions thereof, without penalty or termination charge. The Contractor agrees to take back such Deliverables and refund any sums the State has paid Contractor less any reasonable amount for use or damage. c) The Contractor shall have no liability to the State under any provision of this clause with respect to any claim of patent, copyright or trade secret infringement which is based upon: i. The combination or utilization of Deliverables furnished hereunder with Equipment, Software or devices not made or furnished by the Contractor; or, DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 36 of 103 GSPD-401IT-CMAS CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) GENERAL PROVISIONS – INFORMATION TECHNOLOGY REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 20 OF 61 ii. The operation of Equipment furnished by the Contractor under the control of any Operating Software other than, or in addition to, the current version of Contractor-supplied Operating Software; or iii. The modification initiated by the State, or a third party at the State’s direction, of any Deliverable furnished hereunder; or iv. The combination or utilization of Software furnished hereunder with non-Contractor supplied Software. d) The Contractor certifies that it has appropriate systems and controls in place to ensure that State funds will not be used in the performance of this Contract for the acquisition, operation or maintenance of computer Software in violation of copyright laws. 44. DISPUTES: a) The parties shall deal in good faith and attempt to resolve potential disputes informally. If the dispute persists, the Contractor shall submit to the Department Director or designee a written demand for a final decision regarding the disposition of any dispute between the parties arising under, related to or involving this Contract. Contractor’s written demand shall be fully supported by factual information, and if such demand involves a cost adjustment to the Contract, Contractor shall include with the demand a written statement signed by an authorized person indicating that the demand is made in good faith, that the supporting data are accurate and complete and that the amount requested accurately reflects the Contract adjustment for which Contractor believes the State is liable. The contracting Department Director or designee shall have 30 days after receipt of Contractor’s written demand invoking this Section “Disputes” to render a written decision. If a written decision is not rendered within 30 days after receipt of contractor’s demand, it shall be deemed a decision adverse to the Contractor’s contention. If the Contractor is not satisfied with the decision of the Department Director or designee, the Contractor may appeal the decision, in writing, within 15 days of its issuance (or the expiration of the 30-day period in the event no decision is rendered by the contracting department), to the Department of General Services, Deputy Director, Procurement Division, who shall have 45 days to render a final decision. If the Contractor does not appeal the decision of the contracting Department Director or designee, the decision shall be conclusive and binding regarding the dispute and the Contractor shall be barred from commencing an action in court, or with the Victims Compensation Government Claims Board, for failure to exhaust Contractor’s administrative remedies. b) Pending the final resolution of any dispute arising under, related to or involving this Contract, Contractor agrees to diligently proceed with the performance of this Contract, including the delivery of Goods or providing of services in accordance with the State’s instructions regarding this Contract. Contractor’s failure to diligently proceed in accordance with the State’s instructions regarding this Contract shall be considered a material breach of this Contract. c) Any final decision of the State shall be expressly identified as such, shall be in writing, and shall be signed by the Deputy Director, Procurement Division if an appeal was made. If the Deputy Director, Procurement Division fails to render a final decision within 45 days after receipt of Contractor’s demand, it shall be deemed a final decision adverse to Contractor’s contentions. The State’s final decision shall be conclusive and binding regarding the dispute unless Contractor commences an action in a court of competent jurisdiction to contest such decision within 90 days following the date of the final decision or 1 year following the accrual of the cause of action, whichever is later. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 37 of 103 GSPD-401IT-CMAS CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) GENERAL PROVISIONS – INFORMATION TECHNOLOGY REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 21 OF 61 d) For disputes involving purchases made by the Department of General Services, Procurement Division, the Contractor shall submit to the Department Director or designee a written demand for a final decision, which shall be fully supported in the manner described in the subsection a above. The Department Director or designee shall have 30 days to render a final decision. If a final decision is not rendered within 30 days after receipt of the Contractor’s demand, it shall be deemed a final decision adverse to the Contractor’s contention. The final decision shall be conclusive and binding regarding the dispute unless the Contractor commences an action in a court of competent jurisdiction to contest such decision within 90 days following the date of the final decision or 1 year following the accrual of the cause of action, whichever is later. The dates of decision and appeal in this section may be modified by mutual consent, as applicable, excepting the time to commence an action in a court of competent jurisdiction. 45. STOP WORK: a) The State may, at any time, by written Stop Work Order to the Contractor, require the Contractor to stop all, or any part, of the work called for by this Contract for a period up to 45 days after the Stop Work Order is delivered to the Contractor, and for any further period to which the parties may agree. The Stop Work Order shall be specifically identified as such and shall indicate it is issued under this clause. Upon receipt of the Stop Work Order, the Contractor shall immediately comply with its terms and take all reasonable steps to minimize the incurrence of costs allocable to the work covered by the Stop Work Order during the period of work stoppage. Within a period of 45 days after a Stop Work Order is delivered to the Contractor, or within any extension of that period to which the parties shall have agreed, the State shall either: i. Cancel the Stop Work Order; or ii. Terminate the work covered by the Stop Work Order as provided for in the termination for default or the termination for convenience clause of this Contract. b) If a Stop Work Order issued under this clause is canceled or the period of the Stop Work Order or any extension thereof expires, the Contractor shall resume work. The State shall make an equitable adjustment in the delivery schedule, the Contract price, or both, and the Contract shall be modified, in writing, accordingly, if: i. The Stop Work Order results in an increase in the time required for, or in the Contractor’s cost properly allocable to the performance of any part of this Contract; and ii. The Contractor asserts its right to an equitable adjustment within 60 days after the end of the period of work stoppage; provided, that if the State decides the facts justify the action, the State may receive and act upon a proposal submitted at any time before final payment under this Contract. c) If a Stop Work Order is not canceled and the work covered by the Stop Work Order is terminated in accordance with the provision entitled Termination for the Convenience of the State, the State shall allow reasonable costs resulting from the Stop Work Order in arriving at the termination settlement. d) The State shall not be liable to the Contractor for loss of profits because of a Stop Work Order issued under this clause. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 38 of 103 GSPD-401IT-CMAS CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) GENERAL PROVISIONS – INFORMATION TECHNOLOGY REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 22 OF 61 46. EXAMINATION AND AUDIT: Contractor agrees that the State, or its designated representative shall have the right to review and copy any records and supporting documentation pertaining to performance of this Contract. The Contractor agrees to maintain such records for possible audit for a minimum of three years after final payment, unless a longer period of records retention is stipulated. The Contractor agrees to allow the auditor(s) access to such records during normal business hours and in such a manner so as to not interfere unreasonably with normal business activities and to allow interviews of any employees or others who might reasonably have information related to such records. Further, Contractor agrees to include a similar right of the State to audit records and interview staff in any subcontract related to performance of this Contract. The State shall provide reasonable advance written notice of such audit(s) to the Contractor. 47. FOLLOW-ON CONTRACTS: a) If the Contractor or its affiliates provides Technical Consulting and Direction (as defined below), the Contractor and its affiliates: i. will not be awarded a subsequent Contract to supply the service or system, or any significant component thereof, that is used for or in connection with any subject of such Technical Consulting and Direction; and ii. will not act as consultant to any person or entity that does receive a Contract described in subsection (i). This prohibition will continue for one year after termination of this Contract or completion of the Technical Consulting and Direction, whichever comes later. b) “Technical Consulting and Direction” means services for which the Contractor received compensation from the State and includes: i. development of or assistance in the development of work statements, specifications, solicitations, or feasibility studies; ii. development or design of test requirements; iii. evaluation of test data; iv. direction of or evaluation of another Contractor; v. provision of formal recommendations regarding the acquisition of Information Technology products or services; or vi. provisions of formal recommendations regarding any of the above. For purposes of this Section, “affiliates” are employees, directors, partners, joint venture participants, parent corporations, subsidiaries, or any other entity controlled by, controlling, or under common control with the Contractor. Control exists when an entity owns or directs more than 50 percent of the outstanding shares or securities representing the right to vote for the election of directors or other managing authority. c) To the extent permissible by law, the Director of the Department of General Services, or designee, may waive the restrictions set forth in this Section by written notice to the Contractor if the Director determines their application would not be in the State’s best interest. Except as prohibited by law, the restrictions of this Section will not apply: i. to follow-on advice given by vendors of commercial off-the-shelf products, including Software and Hardware, on the operation, integration, repair, or maintenance of such products after sale; or DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 39 of 103 GSPD-401IT-CMAS CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) GENERAL PROVISIONS – INFORMATION TECHNOLOGY REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 23 OF 61 ii. where the State has entered into a master agreement for Software or services and the scope of work at the time of Contract execution expressly calls for future recommendations among the Contractor’s own products. d) The restrictions set forth in this Section are in addition to conflict of interest restrictions imposed on public Contractors by California law (“Conflict Laws”). In the event of any inconsistency, such Conflict Laws override the provisions of this Section, even if enacted after execution of this Contract. 48. PRIORITY HIRING CONSIDERATIONS: If this Contract includes services in excess of $200,000, the Contractor shall give priority consideration in filling vacancies in positions funded by the Contract to qualified recipients of aid under Welfare and Institutions Code Section 11200 in accordance with Public Contract Code (PCC) Section 10353. 49. COVENANT AGAINST GRATUITIES: The Contractor warrants that no gratuities (in the form of entertainment, gifts, or otherwise) were offered or given by the Contractor, or any agent or representative of the Contractor, to any officer or employee of the State with a view toward securing the Contract or securing favorable treatment with respect to any determinations concerning the performance of the Contract. For breach or violation of this warranty, the State shall have the right to terminate the Contract, either in whole or in part, and any loss or damage sustained by the State in procuring on the open market any items which Contractor agreed to supply shall be borne and paid for by the Contractor. The rights and remedies of the State provided in this clause shall not be exclusive and are in addition to any other rights and remedies provided by law or in equity. 50. NONDISCRIMINATION CLAUSE: a) During the performance of this Contract, the Contractor and its subcontractors shall not unlawfully discriminate, harass or allow harassment, against any employee or applicant for employment because of sex, sexual orientation, race, color, ancestry, religious creed, national origin, disability (including HIV and AIDS), medical condition (cancer), age, marital status, and denial of family care leave. The Contractor and subcontractors shall insure that the evaluation and treatment of their employees and applicants for employment are free from such discrimination and harassment. The Contractor and subcontractors shall comply with the provisions of the Fair Employment and Housing Act (Government Code, Section 12990 et seq.) and the applicable regulations promulgated thereunder (California Code of Regulations, Title 2, Section 7285.0 et seq.). The applicable regulations of the Fair Employment and Housing Commission implementing Government Code Section 12990 (a-f), set forth in Chapter 5 of Division 4 of Title 2 of the California Code of Regulations are incorporated into this Contract by reference and made a part hereof as if set forth in full. The Contractor and its subcontractors shall give written notice of their obligations under this clause to labor organizations with which they have a collective bargaining or other agreement. b) The Contractor shall include the nondiscrimination and compliance provisions of this clause in all subcontracts to perform work under the Contract. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 40 of 103 GSPD-401IT-CMAS CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) GENERAL PROVISIONS – INFORMATION TECHNOLOGY REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 24 OF 61 51. NATIONAL LABOR RELATIONS BOARD CERTIFICATION: The Contractor swears under penalty of perjury that no more than one final, unappealable finding of contempt of court by a federal court has been issued against the Contractor within the immediately preceding two-year period because of the Contractor’s failure to comply with an order of the National Labor Relations Board. This provision is required by, and shall be construed in accordance with, PCC Section 10296. 52. ASSIGNMENT OF ANTITRUST ACTIONS: Pursuant to Government Code Sections 4552, 4553, and 4554, the following provisions are incorporated herein: a) In submitting an offer to the State, the supplier offers and agrees that if the offer is accepted, it will assign to the State all rights, title, and interest in and to all causes of action it may have under Section 4 of the Clayton Act (15 U.S.C. 15) or under the Cartwright Act (Chapter 2, commencing with Section 16700, of Part 2 of Division 7 of the Business and Professions Code), arising from purchases of Goods, material or other items, or services by the supplier for sale to the State pursuant to the solicitation. Such assignment shall be made and become effective at the time the State tenders final payment to the supplier. b) If the State receives, either through judgment or settlement, a monetary recovery for a cause of action assigned under this chapter, the assignor shall be entitled to receive reimbursement for actual legal costs incurred and may, upon demand, recover from the State any portion of the recovery, including treble damages, attributable to overcharges that were paid by the assignor but were not paid by the State as part of the offer price, less the expenses incurred in obtaining that portion of the recovery. c) Upon demand in writing by the assignor, the assignee shall, within one year from such demand, reassign the cause of action assigned under this part if the assignor has been or may have been injured by the violation of law for which the cause of action arose and i. the assignee has not been injured thereby, or ii. the assignee declines to file a court action for the cause of action. 53. DRUG-FREE WORKPLACE CERTIFICATION: The Contractor certifies under penalty of perjury under the laws of the State of California that the Contractor will comply with the requirements of the Drug-Free Workplace Act of 1990 (Government Code Section 8350 et seq.) and will provide a drug-free workplace by taking the following actions: a) Publish a statement notifying employees that unlawful manufacture, distribution, dispensation, possession, or use of a controlled substance is prohibited and specifying actions to be taken against employees for violations, as required by Government Code Section 8355(a). b) Establish a Drug-Free Awareness Program as required by Government Code Section 8355(b) to inform employees about all of the following: i. the dangers of drug abuse in the workplace; ii. the person's or organization's policy of maintaining a drug-free workplace; iii. any available counseling, rehabilitation, and employee assistance programs; and, iv. penalties that may be imposed upon employees for drug abuse violations. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 41 of 103 GSPD-401IT-CMAS CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) GENERAL PROVISIONS – INFORMATION TECHNOLOGY REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 25 OF 61 c) Provide, as required by Government Code Section 8355(c), that every employee who works on the proposed or resulting Contract: i. will receive a copy of the company's drug-free policy statement; and, ii. will agree to abide by the terms of the company's statement as a condition of employment on the Contract. 54. FOUR-DIGIT DATE COMPLIANCE: Contractor warrants that it will provide only Four-Digit Date Compliant (as defined below) Deliverables and/or services to the State. “Four Digit Date Compliant” Deliverables and services can accurately process, calculate, compare, and sequence date data, including without limitation date data arising out of or relating to leap years and changes in centuries. This warranty and representation is subject to the warranty terms and conditions of this Contract and does not limit the generality of warranty obligations set forth elsewhere herein. 55. SWEATFREE CODE OF CONDUCT: a) Contractor declares under penalty of perjury that no equipment, materials, or supplies furnished to the State pursuant to the Contract have been produced in whole or in part by sweatshop labor, forced labor, convict labor, indentured labor under penal sanction, abusive forms of child labor or exploitation of children in sweatshop labor, or with the benefit of sweatshop labor, forced labor, convict labor, indentured labor under penal sanction, abusive forms of child labor or exploitation of children in sweatshop labor. Contractor further declares under penalty of perjury that they adhere to the Sweatfree Code of Conduct as set forth on the California Department of Industrial Relations website located at www.dir.ca.gov, and Public Contract Code Section 6108. b) Contractor agrees to cooperate fully in providing reasonable access to its records, documents, agents or employees, or premises if reasonably required by authorized officials of the State, the Department of Industrial Relations, or the Department of Justice to determine Contractor’s compliance with the requirements under paragraph (a). 56. RECYCLED CONTENT REQUIREMENTS: The Contractor shall certify in writing under penalty of perjury, the minimum, if not exact, percentage of postconsumer material as defined in the PCC Section 12200-12209, in products, materials, goods, or supplies offered or sold to the State that fall under any of the statutory categories regardless of whether the product meets the requirements of Section 12209. The certification shall be provided by the contractor, even if the product or good contains no postconsumer recycled material, and even if the postconsumer content is unknown. With respect to printer or duplication cartridges that comply with the requirements of Section 12156(e), the certification required by this subdivision shall specify that the cartridges so comply (PCC 12205 (b)(2)). A state agency contracting officer may waive the certification requirements if the percentage of postconsumer material in the products, materials, goods, or supplies can be verified in a written advertisement, including, but not limited to, a product label, a catalog, or a manufacturer or vendor Internet web site. Contractors are to use, to the maximum extent economically feasible in the performance of the contract work, recycled content products (PCC 12203(d)). DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 42 of 103 GSPD-401IT-CMAS CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) GENERAL PROVISIONS – INFORMATION TECHNOLOGY REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 26 OF 61 57. CHILD SUPPORT COMPLIANCE ACT: For any Contract in excess of $100,000, the Contractor acknowledges in accordance with PCC Section 7110, that: a) The Contractor recognizes the importance of child and family support obligations and shall fully comply with all applicable State and federal laws relating to child and family support enforcement, including, but not limited to, disclosure of information and compliance with earnings assignment orders, as provided in Chapter 8 (commencing with Section 5200) of Part 5 of Division 9 of the Family Code; and b) The Contractor, to the best of its knowledge is fully complying with the earnings assignment orders of all employees and is providing the names of all new employees to the New Hire Registry maintained by the California Employment Development Department. 58. AMERICAN WITH DISABILITIES ACT: The Contractor assures the State that the Contractor complies with the Americans with Disabilities Act of 1990 (42 U.S.C. 12101 et seq.). 59. ELECTRONIC WASTE RECYCLING ACT OF 2003: The Contractor certifies that it complies with the applicable requirements of the Electronic Waste Recycling Act of 2003, Chapter 8.5, Part 3 of Division 30, commencing with Section 42460 of the Public Resources Code. The Contractor shall maintain documentation and provide reasonable access to its records and documents that evidence compliance. 60. USE TAX COLLECTION: In accordance with PCC Section 10295.1, the Contractor certifies that it complies with the requirements of Section 7101 of the Revenue and Taxation Code. Contractor further certifies that it will immediately advise the State of any change in its retailer’s seller’s permit or certification of registration or applicable affiliate’s seller’s permit or certificate of registration as described in subdivision (a) of PCC Section 10295.1. 61. EXPATRIATE CORPORATIONS: Contractor hereby declares that it is not an expatriate corporation or subsidiary of an expatriate corporation within the meaning of PCC Sections 10286 and 10286.1, and is eligible to Contract with the State. 62. DOMESTIC PARTNERS: For Contracts over $100,000 executed or amended after January 1, 2007, the Contractor certifies that the Contractor is in compliance with Public Contract Code Section 10295.3. 63. SMALL BUSINESS PARTICIPATION AND DVBE PARTICIPATION REPORTING REQUIREMENTS: a) If for this Contract the Contractor made a commitment to achieve small business participation, then the Department requires the Contractor upon completion of this Contract (or within such other time period as may be specified elsewhere in this Contract) to report to the actual percentage of small business participation that was achieved. (Govt. Code 14841.) DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 43 of 103 GSPD-401IT-CMAS CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) GENERAL PROVISIONS – INFORMATION TECHNOLOGY REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 27 OF 61 b) If for this Contract the Contractor made a commitment to achieve disabled veteran business enterprise (DVBE) participation goal, then, pursuant to Mil. & Vets. Code 999.5(d), upon completion of this Contract, the Department requires the Contractor to certify using the Prime Contractor’s Certification – DVBE Subcontracting Report (STD 817), all of the following: i. the total amount the prime Contractor received under the Contract; ii. the name, address, Contract number, and certification ID number of the DVBE(s) that participated in the performance of the Contract; iii. the amount and percentage of work the prime Contractor committed to provide to one or more DVBE(s) under the requirements of the Contract and the total payment each DVBE received from the prime Contractor; iv. that all payments under the Contract have been made to the DVBE; and v. the actual percentage of DVBE participation that was achieved. Upon request, the prime Contractor shall provide proof of payment for the work. If for this Contract the Contractor made a commitment to achieve the DVBE participation goal, the Department will withhold $10,000 from the final payment, or the full final payment if less than $10,000, until the Contractor complies with the certification requirements above. A Contractor that fails to comply with the certification requirement shall, after written notice, be allowed to cure the defect. Notwithstanding any other law, if, after at least 15 calendar days but not more than 30 calendar days from the date of written notice, the prime contractor refuses to comply with the certification requirements, the Department shall permanently deduct $10,000 from the final payment, or the full payment if less than $10,000. (Mil. & Vets. Code 999.7) A person or entity that knowingly provides false information shall be subject to a civil penalty for each violation. (Mil. & Vets. Code 999.5(d); Govt. Code 14841) Contractor agrees to comply with the rules, regulations, ordinances, and statutes that apply to the DVBE program as defined in Section 999 of the Mil. & Vets. Code, including, but not limited to, the requirements of Section 999.5(d). (PCC 10230) 64. LOSS LEADER: It is unlawful for any person engaged in business within this state to sell or use any article or product as a “loss leader” as defined in Section 17030 of the Business and Professions Code. (PCC 12104.5(b).). ADDITIONAL CMAS TERMS AND CONDITIONS 65. CMAS - CONTRACTOR’S LICENSE REQUIREMENTS: Contracts that include installation or the wording “Furnish and Install” require at the time of Contract award that Contractors possess a valid California State Contractor’s License. If subcontractors are used, they must also possess a valid California State Contractor’s License. All businesses which construct or alter any building, highway, road, parking facility, railroad, excavation, or other structure in California must be licensed by the California State License Board (CSLB) if the total cost (labor and materials) of the project is $500 or more. Failure to be licensed or to keep the license current and in good standing shall be grounds for Contract revocation. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 44 of 103 GSPD-401IT-CMAS CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) GENERAL PROVISIONS – INFORMATION TECHNOLOGY REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 28 OF 61 66. CMAS - PUBLIC WORKS REQUIREMENTS (LABOR/INSTALLATION): a) Prior to the commencement of performance, the Contractor must obtain and provide to the State, a payment bond, on Standard Form 807, when the Contract involves a public works expenditure (labor/installation costs) in excess of $5,000. Such bond shall be in a sum not less than 100 percent of the Contract price. b) In accordance with the provisions of Section 1773 of the California Labor Code, the Contractor shall, conform and stipulates to the general prevailing rate of wages, including employer benefits as defined in Section 1773.1 of the California Labor Code, applicable to the classes of labor to be used for public works such as at the delivery site for the assembly and installation of the equipment or materials under the purchase order. Pursuant to Section 1770 of the California Labor Code, the Department of Industrial Relations has ascertained the general prevailing rate of wages in the county in which the work is to be done, to be as listed in the booklet entitled General Prevailing Wage Rates. The booklet is compiled monthly and copies of the same are available from the Department of Industrial Relations, Prevailing Wage Unit at www.dir.ca.gov (select Statistics & Research) or (415) 703-4774. The booklet is required to be posted at the job site. c) The Contractor hereby certifies by signing this Contract that: i. Contractor has met or will comply with the standards of affirmative compliance with the Non-Discrimination Clause Requirements included herein; ii. Contractor is aware of the provisions of Section 3700 of the Labor Code that require every employer to be insured against liability for workmen's compensation or to undertake self- insurance in accordance with the provisions of that Code, and Contractor will comply with such provisions before commencing the performance of the work of the purchase order. d) Laws to be Observed i. Labor Pursuant to Section 1775 of the California Labor Code the Contractor shall, as a penalty to the State or Political subdivision on whose behalf the purchase order is made or awarded, forfeit not more than fifty dollars for each calendar day, or portions thereof, for each worker paid by him or subcontractor under him, less than the prevailing wage so stipulated; and in addition, the Contractor further agrees to pay to each workman the difference between the actual amount paid for each calendar day, or portions thereof, and the stipulated prevailing wage rate for the same. This provision shall not apply to properly indentured apprentices. Pursuant to Sections 1810-1815 of the California Labor Code, inclusive, it is further agreed that the maximum hours a worker is to be employed is limited to eight hours a day and forty hours a week and the Contractor shall forfeit, as a penalty to the State, twenty-five dollars for each worker employed in the execution of the purchase order for each calendar day during which a workman is required or permitted to labor more than eight hours in any calendar day or more than forty hours in any calendar week, in violation of California Labor Code Sections 1810- 1815, inclusive. ii. Worker's Compensation Insurance The Contractor will be required to secure the payment of compensation to its employees in accordance with the provisions of Labor Code Section 3700. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 45 of 103 GSPD-401IT-CMAS CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) GENERAL PROVISIONS – INFORMATION TECHNOLOGY REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 29 OF 61 iii. Travel and Subsistence Payments Travel and subsistence payments shall be paid to each worker needed to execute the work, as such travel and subsistence payments are defined in the applicable collective bargaining agreements filed in accordance with Labor Code Section 1773.8. iv. Apprentices Special attention is directed to Sections 1777.5, 1777.6, and 1777.7 of the California Labor Code and Title 8, California Administrative Code Section 200 et seq. Each Contractor and/or subcontractor must, prior to commencement of the public works Contract/purchase order, contact the Division of Apprenticeship Standards, 525 Golden Gate Avenue, San Francisco, CA, or one of its branch offices to insure compliance and complete understanding of the law regarding apprentices and specifically the required ratio thereunder. Responsibility for compliance with this section lies with the prime Contractor. v. Payroll The Contractor shall keep an accurate payroll record showing the name, social security account, and work classification specific and straight time and overtime hours worked by each employee. A certified copy of the employee’s payroll record shall be available for inspection as specified in Section 1776 of the California Labor Code. 67. CMAS - TERMINATION OF CMAS CONTRACT: a) The State may terminate this CMAS Contract at any time upon 30 days prior written notice. b) If the Contractor's GSA Multiple Award Schedule is terminated within the term of the CMAS Contract, the CMAS Contract shall also be considered terminated on the same date. c) Prior to the expiration of this CMAS Contract, this Contract may be terminated for the convenience of both parties by mutual consent. d) This provision shall not relieve the Contractor of the obligation to perform under any purchase order or other similar ordering document executed prior to the termination becoming effective. 68. CMAS - CONTRACT AMOUNT: There is no guarantee of minimum purchase of Contractor's products or services by the State. 69. CMAS - DEBARMENT CERTIFICATION (FEDERALLY FUNDED CONTRACTS): When Federal funds are being expended, the prospective recipient of Federal assistance funds is required to certify to the Buyer, that neither it nor its principals are presently debarred, suspended, proposed for debarment, declared ineligible, or voluntarily excluded from participation in this transaction by any Federal department or agency. 70. CMAS - PURCHASE ORDERS FUNDED IN WHOLE OR PART BY THE FEDERAL GOVERNMENT: All Contracts (including individual orders), except for State construction projects, which are funded in whole or in part by the federal government may be canceled with 30-day notice, and are subject to the following: a) It is mutually understood between the parties that this Contract (order) may have been written before ascertaining the availability of congressional appropriation of funds, for the mutual benefit of both parties, in order to avoid program and fiscal delays which would occur if the Contract (order) were executed after that determination was made. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 46 of 103 GSPD-401IT-CMAS CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) GENERAL PROVISIONS – INFORMATION TECHNOLOGY REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 30 OF 61 b) This Contract (order) is valid and enforceable only if sufficient funds are made available to the State by the United States Government for the fiscal year during which the order was generated for the purposes of this program. In addition, this Contract (order) is subject to any additional restrictions, limitations, or conditions enacted by the Congress or any statute enacted by the Congress that may affect the provisions, terms or funding of this Contract (order) in any manner. c) It is mutually agreed that if the Congress does not appropriate sufficient funds for the program, this Contract (order) shall be amended to reflect any reduction in funds. The department has the option to void the Contract (order) under the 30-day cancellation clause or to amend the Contract to reflect any reduction of funds. 71. CMAS - CONFLICT OF INTEREST: a) Current State Employees (Public Contract Code Section 10410): i. No officer or employee shall engage in any employment, activity or enterprise from which the officer or employee receives compensation or has a financial interest and which is sponsored or funded by any State agency, unless the employment, activity or enterprise is required as a condition of regular State employment. ii. No officer or employee shall Contract on his or her own behalf as an independent Contractor with any State agency to provide Goods or services. b) Former State Employees (Public Contract Code Section 10411): i. For the two-year period from the date he or she left State employment, no former State officer or employee may enter into a Contract in which he or she engaged in any of the negotiations, transactions, planning, arrangements or any part of the decision-making process relevant to the Contract while employed in any capacity by any State agency. ii. For the twelve-month period from the date he or she left State employment, no former State officer or employee may enter into a Contract with any State agency if he or she was employed by that State agency in a policy-making position in the same general subject area as the proposed Contract within the twelve-month period prior to his or her leaving State service. 72. CMAS - SUBCONTRACTING REQUIREMENTS: Any subcontractor that the CMAS supplier chooses to use in fulfilling the requirements of this Contract (order) and is expected to receive more than 10 percent of the value of the Contract/purchase order must also meet all Contractual requirements of the Contract (order). 73. CMAS - RENTAL AGREEMENTS: The State does not agree to: • Indemnify a Contractor; • Assume responsibility for matters beyond its control; • Agree to make payments in advance; • Accept any other provision creating a contingent liability against the State; or • Agree to obtain insurance to protect the Contractor. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 47 of 103 GSPD-401IT-CMAS CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) GENERAL PROVISIONS – INFORMATION TECHNOLOGY REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 31 OF 61 The State’s responsibility for repairs and liability for damage or loss is restricted to that made necessary by or resulting from the negligent act or omission of the State or its officers, employees, or agents. If the Contractor maintains the equipment, the Contractor must keep the equipment in good working order and make all necessary repairs and adjustments without qualification. The State may terminate for default or cease paying rent should the Contractor fail to maintain the equipment properly. Personal property taxes are not generally reimbursed when leasing equipment (SAM 8736). 74. CMAS - LEASE (LEASE SMART): If an agency desires to lease through Lease SMart, the Contractor agrees to sell to lessor the assets at the same price as they agree to sell to the State. 75. CMAS - PROGRESS PAYMENTS & RISK ASSESSMENT: In accordance with PCC 12112 agencies are required to withhold not less than 10 percent of the Contract price until final delivery and acceptance of the Goods or services, for any Contract that provides for progress payments in a Contract for IT Goods or services to be manufactured or performed by a Contractor especially for the State and not suitable for sale to others in the ordinary course of the Contractor’s business. Interim Risk Assessment guidelines and financial protection measures are detailed in PCC 12112 for agencies to use to determine their applicability to agency projects. 76. CMAS - QUARTERLY REPORTS: Contractors are required to submit quarterly business activity reports, as specified in this Contract, even when there is no activity. A separate report is required for each Contract, as differentiated by alpha suffix. 77. CMAS - CONTRACTOR EVALUATION: In accordance with PCC 10367 and 10369, performance of the Contractor under orders issued against this Contract will be evaluated. The ordering agency shall complete a written evaluation, and if the Contractor did not satisfactorily perform the work specified, a copy of the evaluation will be sent to the DGS, Office of Legal Services. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 48 of 103 CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) STATE MODEL CLOUD COMPUTING SERVICES SPECIAL PROVISIONS (Software as a Service) REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 32 OF 61 THESE CLOUD COMPUTING – SOFTWARE AS A SERVICE GENERAL PROVISIONS ARE ONLY TO BE USED FOR SOFTWARE AS A SERVICE (SaaS), AS DEFINED BELOW, AND ANY ANCILLARY SERVICES. THE CLOUD COMPUTING SERVICES SPECIAL PROVISIONS (SOFTWARE AS A SERVICE) ARE INCORPORATED BY REFERENCE UNLESS SPECIFICALLY MODIFIED AND ATTACHED HERETO. THIS CONTRACT SHALL BE ACCOMPANIED BY A STATEMENT OF WORK (SOW) AND SERVICE LEVEL AGREEMENT (SLA), IN ADDITION TO STANDARD EXHIBITS. 1. DEFINITIONS: Unless otherwise specified in the Statement of Work, the following terms shall be given the meaning shown, unless context requires otherwise. a) “Application Program" means a computer program that is intended to be executed for the purpose of performing useful work for the user of the information being processed. Application Programs are developed or otherwise acquired by the User of the Hardware/Software system, but they may be supplied by the Contractor. b) “Buyer” means the State’s authorized contracting official. c) “Contract” means this Contract or agreement (including any purchase order), by whatever name known or in whatever format used. d) “Contractor” means the business entity with whom the State enters into this Contract. Contractor shall be synonymous with supplier, vendor, Reseller, Service Provider, or other similar term. e) “Customer” means the State or an Eligible Public Entity using the Contractor’s or the Service Provider’s Services. f) “Deliverables” means the tangible products or works of authorship and other items (e.g. reports) to be delivered pursuant to this Contract, including any such items furnished that are incidental to the provision of Services. g) "Documentation" means manuals and other published materials necessary or useful to the State in its use or maintenance of the products and Services provided hereunder and includes online materials, virtual help, and help desk where available. In addition, manuals and other published materials customized for the State hereunder constitute Work Product as defined below. h) “Eligible Public Entity” means each of the non-State public entities authorized to purchase the Deliverables and Services offered hereunder. “Eligible Public Entity” includes the county, city, city and county, district, public authority, public agency, municipal corporation, or any other political subdivision or public corporation in the State. “Eligible Public Entity” also includes a federally-recognized tribal entity acting in its tribal governmental capacity. i) “Goods” means all types of tangible personal property, including but not limited to materials, supplies, and equipment (including computer and telecommunications equipment). j) "Hardware" refers to computer equipment and is contrasted with Software. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 49 of 103 CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) STATE MODEL CLOUD COMPUTING SERVICES SPECIAL PROVISIONS (Software as a Service) REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 33 OF 61 k) “Information Technology” includes, but is not limited to, all electronic technology systems and services, automated information handling, system design and analysis, conversion of data, computer programming, information storage and retrieval, telecommunications which include voice, video, and data communications, requisite system controls, simulation, electronic commerce, and all related interaction between people and machines. l) "Maintenance" includes: i) remedial maintenance performed by the Contractor which results from a Services failure and which is performed as required, i.e., on an unscheduled basis; and ii) the maintenance performed on a scheduled basis by the Contractor. m) “Reseller” means the agent(s) of the Service Provider or the business entity authorized by the Service Provider to resell the Services or perform aspects of this Contract as specified herein including, but not limited to sales, fulfillment, invoicing, returns, and customer service. n) “Service Provider” means the Contractor, subcontractors, agents, Resellers, third parties and affiliates of the Contractor, the cloud service provider, or managed service provider who may provide the Services agreed to under the Contract. o) "Services" means the cloud computing services, including Software as a Service (but not Infrastructure as a Service or Platform as a Service), and any related services, offered to the State by the Contractor herein. p) "Software" means an all-inclusive term which refers to any computer programs, routines, or subroutines supplied by the Contractor, including operating Software, Application Programs, and enabling software (“Software Products”) that the State downloads to the State’s systems to facilitate use of the Service. q) “Software as a Service (SaaS)” is the capability provided to the Customer to use applications made available by the Service Provider running on a cloud infrastructure. The applications are accessible from various client devices through a thin client interface such as a web browser (e.g., web-based email). The Customer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings. r) "State" means the government of the State of California, its employees and authorized representatives, including without limitation any department, agency, or other unit of the government of the State of California. s) “State Data” means all data owned by the State, and submitted to, processed by, or stored by the Service Provider under this Contract and includes, but is not limited to, all data that originated with the State or Users, all data provided by the State or Users, and data generated, manipulated, produced, reported by or otherwise emanating from or by applications run by the State or Users on the Services. For clarity, State Data is synonymous with “Customer Data”, “Customer Content”, or similar terms, as used in various provisions of the service agreements and incorporated into the Contract and includes the following: i. “Non-Public Data” means data submitted to the Service Provider, other than Personal Data, that is not subject to distribution to the public as public information. It is deemed to be sensitive and confidential by the State because it contains information that may be exempt by statute, regulation, or policy from access by the general public as public information. ii. “Personal Data” means Personal Information as defined by the California Information Practices Act (Civil Code sections 1798 et seq.) submitted to the Service Provider. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 50 of 103 CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) STATE MODEL CLOUD COMPUTING SERVICES SPECIAL PROVISIONS (Software as a Service) REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 34 OF 61 iii. “Public Information” means any information prepared, owned, used, or retained by the State and not specifically exempt from the disclosure requirements of the California Public Records Act (Government Code section 6250 et. seq.) or other applicable state or federal laws. For clarity, "Public Information” is also interchangeable with “Public Data”. t) “Statement of Work” (or “SOW”) means a document provided by the State which defines the timeline, and specifies the objectives, Services, Deliverables and tasks that the Contractor is expected to perform, their responsibilities and expectations, indicating the type, level and quality of service that is expected, all of which form a contractual obligation upon the Contractor in providing Services to the State. The SOW includes detailed technical requirements and pricing, with permitted modifications (“carve- outs”) to the SaaS General and Special Provisions. u) “User" means any authorized end user of the Services under this Contract and includes Customer’s employees, subcontractors, or any system utilized by the Customer to access the Services, whose compliance with the terms of this Contract is the responsibility of the Customer. v) “U.S. Intellectual Property Rights” means intellectual property rights enforceable in the United States of America, including without limitation rights in trade secrets, copyrights, and U.S. patents. 2. CONTRACT FORMATION: a) If this Contract results from a sealed bid offered in response to a solicitation conducted pursuant to Chapters 2 (commencing with section 10290), 3 (commencing with section 12100), and 3.6 (commencing with section 12125) of Part 2 of Division 2 of the Public Contract Code (PCC), then Contractor's bid is a firm offer to the State which is accepted by the issuance of this Contract and no further action is required by either party. b) If this Contract results from a solicitation other than described in paragraph a), above, the Contractor's quotation or proposal is deemed a firm offer and this Contract document is the State's acceptance of that offer. c) If this Contract resulted from a joint bid, it shall be deemed one indivisible Contract. Each such joint Contractor will be jointly and severally liable for the performance of the entire Contract. The State assumes no responsibility or obligation for the division of orders or purchases among joint Contractors. 3. COMPLETE INTEGRATION: This Contract, including any documents incorporated herein by express reference, is intended to be a complete integration and there are no prior or contemporaneous different or additional agreements pertaining to the subject matter of the Contract. 4. SEVERABILITY: The Contractor and the State agree that if any provision of this Contract is found to be illegal or unenforceable, such term or provision shall be deemed stricken and the remainder of the Contract shall remain in full force and effect. Either party having knowledge of such term or provision shall promptly inform the other of the presumed non-applicability of such provision. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 51 of 103 CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) STATE MODEL CLOUD COMPUTING SERVICES SPECIAL PROVISIONS (Software as a Service) REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 35 OF 61 5. INDEPENDENT CONTRACTOR: Contractor and the agents and employees of the Contractor, in the performance of this Contract, shall act in an independent capacity and not as officers or employees or agents of the State. 6. APPLICABLE LAW: This Contract shall be governed by and shall be interpreted in accordance with the laws of the State of California; venue of any action brought with regard to this Contract shall be in Sacramento County, Sacramento, California. The United Nations Convention on Contracts for the International Sale of Goods shall not apply to this Contract. 7. COMPLIANCE WITH STATUTES AND REGULATIONS: a) The State and the Contractor warrant and certify that in the performance of this Contract, it will comply with all applicable statutes, rules, regulations and orders of the United States and the State of California, including the California Information Practices Act (Civil Code sections 1798 et seq.). The Contractor agrees to indemnify, defend, and save harmless the State against any loss, cost, damage or liability by reason of the Contractor’s violation of this provision. b) The State will notify the Contractor of any such claim in writing and tender the defense thereof within reasonable time. c) The Contractor will have sole control of the defense of any action on such claim and all negotiations for its settlement or compromise; provided that (i) when substantial principles of government or public law are involved, when litigation might create precedent affecting future State operations or liability, or when involvement of the State is otherwise mandated by law, the State may participate in such action at its own expense with respect to attorneys’ fees and costs (but not liability); (ii) where a settlement would impose liability on the State, affect principles of California government or public law, or impact the authority of the State, the Department of General Services or the Department of Technology, as applicable, will have the right to approve or disapprove any settlement or compromise, which approval will not unreasonably be withheld or delayed; and (iii) the State will reasonably cooperate in the defense and in any related settlement negotiations. d) If this Contract is in excess of $554,000, it is subject to the requirements of the World Trade Organization (WTO) Government Procurement Agreement (GPA). e) To the extent that this Contract falls within the scope of Government Code section 7405, the Contractor will be responsible to respond to and resolve any complaint brought to its attention, regarding accessibility of its products or Services. The State shall designate an authorized representative who will be responsible for submission to Contractor of complaints received by the State regarding the accessibility of Contractor’s products and Services. Contractor shall be responsible to review and respond to all complaints regarding accessibility brought to the attention of the State. The State and Contractor shall work together to determine a reasonable response and resolution of all complaints. The State acknowledges that Contractor can satisfy its duty to respond to and resolve complaints under this provision by taking action it deems appropriate under the circumstances, which may in some instances include no further action beyond responding to the complaint. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 52 of 103 CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) STATE MODEL CLOUD COMPUTING SERVICES SPECIAL PROVISIONS (Software as a Service) REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 36 OF 61 8. CONTRACTOR’S POWER AND AUTHORITY: The Contractor warrants that it has full power and authority to grant the rights herein granted and will reimburse the State for any loss, cost, liability, and expense (including reasonable attorney fees) arising out of any breach of this warranty. Further, the Contractor avers that it will not enter into any arrangement with any third party which might abridge any rights of the State under this Contract. a) The State will notify the Contractor of any such claim in writing and tender the defense thereof within a reasonable time; and b) The Contractor will have sole control of the defense of any action on such claim and all negotiations for its settlement or compromise; provided that (i) when substantial principles of government or public law are involved, when litigation might create precedent affecting future State operations or liability, or when involvement of the State is otherwise mandated by law, the State may participate in such action at its own expense with respect to attorneys’ fees and costs (but not liability); (ii) where a settlement would impose liability on the State, affect principles of California government or public law, or impact the authority of the State, the Department of General Services or the Department of Technology, as applicable, will have the right to approve or disapprove any settlement or compromise, which approval will not unreasonably be withheld or delayed; and (iii) the State will reasonably cooperate in the defense and in any related settlement negotiations. 9. ASSIGNMENT: This Contract shall not be assignable by the Contractor in whole or in part without the written consent of the State. The State’s consent shall not be unreasonably withheld or delayed. For the purpose of this paragraph, the State will not unreasonably prohibit the Contractor from freely assigning its right to payment, provided that the Contractor remains responsible for its obligations hereunder. 10. WAIVER OF RIGHTS: Any action or inaction by the State or the failure of the State on any occasion, to enforce any right or provision of the Contract, shall not be construed to be a waiver by the State of its rights hereunder and shall not prevent the State from enforcing such provision or right on any future occasion. Except as specifically set forth in Section 13 (Warranty) below, the rights and remedies of the State herein are cumulative and are in addition to any other rights or remedies that the State may have at law or in equity. 11. ORDER OF PRECEDENCE: In the event of any inconsistency between the articles, attachments, specifications or provisions which constitute this Contract, the following order of precedence shall apply: a) These Cloud Computing - Software as a Service General Provisions (In the instances provided herein where the paragraph begins: “Unless otherwise specified in the Statement of Work” provisions specified in the Statement of Work replacing these paragraphs shall take precedence over the paragraph referenced in these General Provisions); DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 53 of 103 CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) STATE MODEL CLOUD COMPUTING SERVICES SPECIAL PROVISIONS (Software as a Service) REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 37 OF 61 b) Contract form, e.g., Purchase Order STD 65, Standard Agreement STD 213, FISCal generated Purchase Order, etc., and any amendments thereto; c) The Cloud Computing Special Provisions – Software as a Service (hereafter referred to as, the “SaaS Special Provisions”), which are incorporated by reference unless specifically modified and attached hereto, and other Special Provisions; d) Statement of Work, including any specifications incorporated by reference herein; e) Cost worksheets; f) The Service Provider’s service agreement and attachments; and g) All other attachments incorporated in the Contract by reference. 12. INSPECTION, ACCEPTANCE AND REJECTION: Unless otherwise specified in the Statement of Work: a) When acquiring SaaS, the State shall rely on Contractor’s existing quality assurance system as a substitute for State inspection and testing. b) For all other acquisitions, Contractor and its subcontractors will provide and maintain a quality assurance system acceptable to the State covering Deliverables and Services under this Contract and will tender to the State only those Deliverables and Services that have been inspected and found to conform to this Contract’s requirements. The Contractor will keep records evidencing inspections and their result, and will make these records available to the State during Contract performance and for three years after final payment. The Contractor shall permit the State to review procedures, practices, processes, and related documents to determine the acceptability of the Contractor’s quality assurance system or other similar business practices related to performance of the Contract. c) In the event any Goods or Deliverables furnished by the Contractor in the performance of the Contract should fail to conform to the requirements herein, the State may reject the same, and it shall become the duty of the Contractor to reclaim and remove the item promptly without expense to the State. 13. WARRANTY: a) Limited Warranty for Services. Unless otherwise specified in the Statement of Work, Contractor warrants that Services furnished hereunder will substantially conform to the requirements of this Contract (including without limitation all descriptions, specifications, and drawings identified in the Statement of Work), and: i. Services will be performed in accordance with the Contract; and ii. All customer support for Services will be performed with professional care and skill. b) Duration of Limited Warranty. The limited warranty will be for the duration of State’s use of the Services, unless the underlying Service Provider’s warranty is shorter in duration, in which case the parties will specify the length of the applicable limited warranty in the Statement of Work. This limited warranty is subject to the following limitations: i. any implied warranties, guarantees, or conditions not able to be disclaimed as a matter of law last for one year from the start of the limited warranty; ii. the limited warranty does not cover problems caused by the State’s accident, abuse or use in a manner inconsistent with this Contract or any applicable service agreement, or resulting from events beyond Contractor’s reasonable control; DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 54 of 103 CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) STATE MODEL CLOUD COMPUTING SERVICES SPECIAL PROVISIONS (Software as a Service) REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 38 OF 61 iii. the limited warranty does not apply to components of Software that the State may be permitted to redistribute; iv. the limited warranty does not apply to free, trial, pre-release, or beta Services; and v. the limited warranty does not apply to problems caused by the State’s failure to meet minimum system requirements. c) Remedies for breach of Limited Warranty. Unless otherwise specified in the Statement of Work, if Contractor fails to meet any of the above limited warranties and the State notifies Contractor within the warranty period, then the State’s remedy and the Contractor’s obligation will be re-performance, repair, replacement, or refund of fees paid. In the event the Contractor fails to re- perform, repair, replace, or refund fees paid for the products and/or Services as appropriate, the State may terminate the Contract. d) Warranty for Software Products. Any Software Products provided by the Service Provider shall be covered by the developer’s consumer warranty that will be passed to the Customer. e) DISCLAIMER OF OTHER WARRANTIES. OTHER THAN THIS LIMITED WARRANTY, CONTRACTOR PROVIDES NO OTHER EXPRESS OR IMPLIED WARRANTIES OR CONDITIONS. CONTRACTOR DISCLAIMS ANY IMPLIED REPRESENTATIONS, WARRANTIES, OR CONDITIONS, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, SATISFACTORY QUALITY, OR TITLE. THESE DISCLAIMERS WILL APPLY UNLESS APPLICABLE LAW DOES NOT PERMIT THEM. f) Contractor shall ensure that the Service Provider shall apply anti-malware controls to the Services to help avoid malicious software gaining unauthorized access to State Data, including malicious software originating from public networks. Such controls shall at all times equal or exceed the controls consistent with the industry standards for such data, but in no event less than the controls that Contractor applies to its own internal corporate electronic data of like character. g) Unless otherwise specified elsewhere in the Contract: i. The Contractor does not warrant that any Services provided hereunder is error-free or that it will run without immaterial interruption; and ii. The Contractor does not warrant and will have no responsibility for a claim to the extent that it arises directly from: a. a modification made by the State, unless such modification is approved or directed by the Contractor, b. use of Services in combination with software or services other than as specified by the Contractor, or c. misuse by the State. h) All warranties, including special warranties specified elsewhere herein, shall inure to the State, its successors, assigns, customer agencies, and governmental users of the Deliverables or Services. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 55 of 103 CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) STATE MODEL CLOUD COMPUTING SERVICES SPECIAL PROVISIONS (Software as a Service) REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 39 OF 61 14. SAFETY AND ACCIDENT PREVENTION: In performing work under this Contract on State premises, the Contractor shall conform to any specific safety requirements contained in the Contract or as required by law or regulation. The Contractor shall take any additional precautions as the State may reasonably require for safety and accident prevention purposes. Any violation of such rules and requirements, unless promptly corrected, shall be grounds for termination of this Contract in accordance with the default provisions hereof. 15. TERMINATION FOR NON-APPROPRIATION OF FUNDS: a) If the term of this Contract extends into fiscal years subsequent to that in which it is approved, such continuation of the Contract is contingent on the appropriation of funds for such purpose by the Legislature or the United States Congress, if applicable. If funds to effect such continued payment are not appropriated, the Contractor agrees to terminate any services supplied to the State under this Contract, and relieve the State of any further obligation therefor. b) The State agrees that if it appears likely that subsection a) above will be invoked, the State and Contractor shall agree to take all reasonable steps to prioritize work and minimize the incurrence of costs prior to the expiration of funding for this Contract. 16. TERMINATION FOR THE CONVENIENCE OF THE STATE: a) The State may terminate performance under this Contract for its convenience in whole or, from time to time, in part, if the Department of General Services, Deputy Director Procurement Division, or designee, determines that a termination is in the State’s interest. The Department of General Services, Deputy Director, Procurement Division, or designee, or the Department of Technology, Deputy Director, Statewide Technology Procurement, or designee, as applicable, shall terminate by delivering to the Contractor a Notice of Termination specifying the extent of termination and the effective date thereof, which shall be no less than 15 days from the Notice of Termination date. b) After receipt of a Notice of Termination, and except as directed by the State, the Contractor shall immediately stop work as specified in the Notice of Termination, regardless of any delay in determining or adjusting any amounts due under this clause. c) After termination, the Contractor shall submit a final termination settlement proposal to the State in the form and with the information prescribed by the State except that in no instance shall the Contractor seek nor will the State pay for Services not utilized or costs not specified on an order for Services regardless of Contractors’ liability or costs for materials, equipment, Software, facilities, or subcontracts. The Contractor shall submit the proposal promptly, but no later than 30 days after the effective date of termination, unless a different time is provided in the Statement of Work or in the Notice of Termination. d) The Contractor and the State may agree upon the whole or any part of the amount to be paid or refunded as requested under subsection (c) above; DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 56 of 103 CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) STATE MODEL CLOUD COMPUTING SERVICES SPECIAL PROVISIONS (Software as a Service) REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 40 OF 61 e) Unless otherwise set forth in the Statement of Work, if the Contractor and the State fail to agree on the amount to be paid because of the termination for convenience. i. The State will pay the Contractor the Contract price for Services accepted or utilized by the State; provided that in no event will total payments exceed the amount payable to the Contractor if the Contract had been fully performed. f) The Contractor will use generally accepted accounting principles, or accounting principles otherwise agreed to in writing by the parties, and sound business practices in determining all costs claimed, agreed to, or determined under this clause. 17. TERMINATION FOR DEFAULT: a) The State may, subject to the clause titled “18. Force Majeure”, by written notice of default to the Contractor, terminate this Contract in whole or in part if the Contractor fails to: i. Perform the Services within the time specified in the Contract or any amendment thereto; ii. Make progress, so that the lack of progress endangers performance of this Contract; or iii. Perform any of the other provisions of this Contract. b) The State’s right to terminate this Contract under subsection a) above, may be exercised only if the failure constitutes a material breach of this Contract and if the Contractor does not cure such failure within the time frame stated in the State’s cure notice, which in no event will be less than 30 days, unless otherwise provided. c) Both parties, State and Contractor, upon any termination for default, have a duty to mitigate the damages suffered by it. The State shall pay Contract price for completed and accepted Deliverables and Services. d) The rights and remedies of the State in this clause are in addition to any other rights and remedies provided by law or under this Contract and are subject to the clause titled “20. Limitation of Liability.” 18. FORCE MAJEURE: Except for defaults of subcontractors at any tier, and any Contractor responsibilities concerning disaster recovery and/or business continuity, the Contractor shall not be liable for any excess costs if the failure to perform the Contract arises from causes beyond the control and without the fault or negligence of the Contractor. Examples of such causes include, but are not limited to: a) Acts of God or of the public enemy, and b) Acts of the federal or State government in either its sovereign or contractual capacity. If the failure to perform is caused by the default of a subcontractor at any tier, and if the cause of the default is beyond the control of both the Contractor and subcontractor, and without the fault or negligence of either, the Contractor shall not be liable for any excess costs for failure to perform. 19. RIGHTS AND REMEDIES OF STATE FOR DEFAULT: a) In the event of the termination of the Contract, either in whole or in part, by reason of default or breach by the Contractor, any subsequent loss or damage sustained by the State in procuring any Deliverables or Services which the Contractor agreed to supply shall be borne and paid for by the Contractor (but subject to the clause entitled “Limitation of Liability”); and DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 57 of 103 CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) STATE MODEL CLOUD COMPUTING SERVICES SPECIAL PROVISIONS (Software as a Service) REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 41 OF 61 b) The State reserves the right to offset the reasonable cost of all damages caused to the State against any outstanding invoices or amounts owed to the Contractor or to make a claim against the Contractor therefore. 20. LIMITATION OF LIABILITY: a) Except as may be otherwise approved by the Department of General Services Deputy Director, Procurement Division or their designee, or the Department of Technology, Deputy Director, Statewide Technology Procurement, or designee, as applicable, Contractor’s liability for damages to the State for any cause whatsoever, and regardless of the form of action, whether in Contract or in tort, shall be limited to the Purchase Price. For purposes of this subsection a), “Purchase Price” will mean the aggregate Contract price; except that, with respect to a Contract under which multiple purchase orders will be issued (e.g., a Master Agreement or Multiple Award Schedule contract), “Purchase Price” will mean the total price of the purchase order for the Deliverable(s) or Service(s) that gave rise to the loss, such that the Contractor will have a separate limitation of liability for each purchase order. b) The foregoing limitation of liability shall not apply: i. to any liability under provisions herein entitled “Compliance with Statutes and Regulations”; ii. to liability under provisions herein entitled “Patent, Copyright, and Trade Secret Indemnity” or to any other liability (including without limitation indemnification obligations) for infringement of third party intellectual property rights; iii. to claims arising under provisions herein calling for indemnification for third party claims against the State for death, bodily injury to persons or damage to real or tangible personal property caused by the Contractor’s negligence or willful misconduct; iv. to costs or attorney’s fees that the State becomes entitled to recover as a prevailing party in any action; or v. to direct costs of mitigation, remediation, and/or notification obligations set forth in the SaaS Special Provisions, resulting from any Data Breach as defined therein, and resulting from the Contractor’s failure to perform or negligent acts of its personnel. c) The State’s liability for damages for any cause whatsoever, and regardless of the form of action, whether in Contract or in tort, shall be limited to the Purchase Price, as that term is defined in subsection a) above. Nothing herein shall be construed to waive or limit the State’s sovereign immunity or any other immunity from suit provided by law. d) IN NO EVENT WILL EITHER THE CONTRACTOR OR THE STATE BE LIABLE FOR CONSEQUENTIAL, INCIDENTAL, INDIRECT, SPECIAL, OR PUNITIVE DAMAGES, EVEN IF NOTIFICATION HAS BEEN GIVEN AS TO THE POSSIBILITY OF SUCH DAMAGES, EXCEPT (I) TO THE EXTENT THAT THE CONTRACTOR’S LIABILITY FOR SUCH DAMAGES IS SPECIFICALLY SET FORTH IN THE STATEMENT OF WORK OR (II) TO THE EXTENT THAT THE CONTRACTOR’S LIABILITY FOR SUCH DAMAGES ARISES OUT OF SUBSECTION b)(i), b)(ii), OR b)(iv) ABOVE. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 58 of 103 CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) STATE MODEL CLOUD COMPUTING SERVICES SPECIAL PROVISIONS (Software as a Service) REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 42 OF 61 21. INDEMNIFICATION: The Contractor agrees to indemnify, defend and save harmless the State, its officers, agents and employees from any and all third party claims, costs (including without limitation reasonable attorneys’ fees), and losses due to the injury or death of any individual, or the loss or damage to any real or tangible personal property, resulting from the willful misconduct or negligent acts or omissions of the Contractor or any of its affiliates, agents, subcontractors, employees, suppliers, or laborers furnishing or supplying work, Services, materials, or supplies in connection with the performance of this Contract. Such defense and payment will be conditional upon the following: a) The State will notify the Contractor of any such claim in writing and tender the defense thereof within a reasonable time; and b) The Contractor will have sole control of the defense of any action on such claim and all negotiations for its settlement or compromise; provided that i. when substantial principles of government or public law are involved, when litigation might create precedent affecting future State operations or liability, or when involvement of the State is otherwise mandated by law, the State may participate in such action at its own expense with respect to attorneys’ fees and costs (but not liability); ii. where a settlement would impose liability on the State, affect principles of California government or public law, or impact the authority of the State, the Department of General Services or the Department of Technology, as applicable, will have the right to approve or disapprove any settlement or compromise, which approval will not unreasonably be withheld or delayed; and iii. the State will reasonably cooperate in the defense and in any related settlement negotiations. 22. INVOICES: Unless otherwise specified, invoices shall be sent to the address set forth herein. Invoices shall be submitted in triplicate and shall include the Contract number; release order number (if applicable); item number; unit price, extended item price and invoice total amount. State sales tax and/or use tax shall be itemized separately and added to each invoice as applicable. 23. REQUIRED PAYMENT DATE: Payment will be made in accordance with the provisions of the California Prompt Payment Act, Government Code section 927 et. seq. Unless expressly exempted by statute, the Act requires State agencies to pay properly submitted, undisputed invoices not more than 45 days after: a) the date of acceptance of Deliverables or performance of Services; or b) receipt of an undisputed invoice, whichever is later. 24. TAXES: Unless otherwise required by law: a) the State of California is exempt from Federal excise taxes; and b) the State will only pay for any applicable State or local sales or use taxes on the services rendered or Goods supplied to the State pursuant to this Contract. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 59 of 103 CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) STATE MODEL CLOUD COMPUTING SERVICES SPECIAL PROVISIONS (Software as a Service) REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 43 OF 61 25. CONTRACT MODIFICATION: a) No amendment or variation of the terms of this Contract shall be valid unless made in writing, signed by the parties and approved as required. No oral understanding or agreement not incorporated in the Contract is binding on any of the parties. b) Notwithstanding subsection a) above, service agreements may be modified by Contractor from time to time, but any such modifications will not degrade the functionality or security features of the SaaS. Service agreements shall be subject to section 11(f) Order of Precedence. 26. CONFIDENTIALITY OF DATA: a) All Customer Data made available to the Contractor in order to carry out this Contract, or which become available to the Contractor in carrying out this Contract, shall be protected by the Contractor from unauthorized use and disclosure by use of the same or more effective confidentiality requirements as are applicable to the State. The identification of all such confidential data and information as well as the State's confidentiality requirements for protection of such data and information from unauthorized use and disclosure shall be provided by the State in writing to the Contractor. If the methods and procedures employed by the Contractor for the protection of the Contractor's data and information are deemed by the State to be adequate for the protection of the State's confidential information, such methods and procedures may be used, with the written consent of the State, to carry out the intent of this paragraph. Any additional requirements to ensure confidentiality of data shall be set forth in the SOW. The Contractor shall not be required under the provisions of this paragraph to keep confidential any data or information which is or becomes publicly available, is already rightfully in the Contractor's possession without obligation of confidentiality, is independently developed by the Contractor outside the scope of this Contract, or is rightfully obtained from third parties. Contractor shall sign a security and confidentiality statement. Contractor is responsible for all Contractor personnel assigned to this Contract and will have appropriate agreements in place to enable Contractor to meet its obligations hereunder. b) The parties acknowledge information transmitted by the State to the Contractor and/or Service Provider may inadvertently contain Federal Tax Information (FTI). The State will use all reasonable efforts to prevent the transmittal of FTI to Contractor and/or Service Provider under this Contract. The State further acknowledges that the Contractor and/or Service Provider does not require any “access” to, or “receipt” or “storage” of FTI to perform the Services under the Contract. The Contractor and/or Service Provider further acknowledges that Contractor and/or Service Provider shall not knowingly access or permit access to such FTI, unless directed by the State. Access to FTI is out-of-scope of the Services. To the extent that Contractor’s and/or Service Provider’s access to FTI is “incidental” to Contractor’s provision of Services, it is the parties’ view that such incidental exposure should not legally subject Contractor and/or Service Provider to the Internal Revenue Service (IRS) requirements set forth in IRS Publication 1075, section 11.2. If, however, the IRS ultimately takes a contrary position, and determines that Contractor, Service Provider and/or the State should have nevertheless complied with the requirements of IRS Publication 1075, the parties will immediately commence an evaluation of the feasibility of continued performance under the Contract. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 60 of 103 CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) STATE MODEL CLOUD COMPUTING SERVICES SPECIAL PROVISIONS (Software as a Service) REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 44 OF 61 27. NEWS RELEASES: Unless otherwise exempted, news releases, endorsements, advertising, and social media content pertaining to this Contract shall not be made without prior written approval of the Department of General Services. 28. DOCUMENTATION: The Contractor agrees to provide to the State, at no charge, all Documentation as described within the Statement of Work, and updated versions thereof, which are necessary or useful to the State in its use of the equipment, Services, or Software provided hereunder. The Contractor agrees to provide additional Documentation at prices not in excess of charges made by the Contractor to its other customers for similar Documentation. 29. RIGHTS IN WORK PRODUCT: a) All inventions, discoveries, intellectual property, technical communications and records originated or prepared by the Contractor pursuant to this Contract including papers, reports, charts, customized software, and other Documentation or improvements thereto, and including the Contractor’s administrative communications and records relating to this Contract (collectively, the “Work Product”), shall be the Contractor’s exclusive property. The provisions of this subsection “a)” may be revised in a Statement of Work. b) Software, other components of SaaS, and materials developed or otherwise obtained by or for the Contractor or its affiliates independently of this Contract or applicable purchase order (“Pre-Existing Materials”) do not constitute Work Product. If the Contractor creates derivative works of Pre-Existing Materials, the elements of such derivative works created pursuant to this Contract constitute Work Product, but other elements do not. Nothing in this Section 29 will be construed to interfere with the Contractor’s or its affiliates’ ownership of Pre- Existing Materials. c) The State will have Government Purpose Rights to the Work Product as Deliverable or delivered to the State hereunder. “Government Purpose Rights” are the unlimited, irrevocable, worldwide, perpetual, royalty-free, non-exclusive rights and licenses to use, modify, reproduce, perform, release, display, create derivative works from, and disclose the Work Product. “Government Purpose Rights” also include the right to release or disclose the Work Product outside the State for any State government purpose and to authorize recipients to use, modify, reproduce, perform, release, display, create derivative works from, and disclose the Work Product for any State government purpose. Such recipients of the Work Product may include, without limitation, State contractors, California local governments, the U.S. federal government, and the state and local governments of other states. “Government Purpose Rights” do not include any rights to use, modify, reproduce, perform, release, display, create derivative works from, or disclose the Work Product for any commercial purpose. This subsection and the rights thereunder may be modified as required for federally funded SaaS pursuant to federal law or regulations, including, but not limited to, 7 CFR 277.18 and 45 CFR 95.617. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 61 of 103 CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) STATE MODEL CLOUD COMPUTING SERVICES SPECIAL PROVISIONS (Software as a Service) REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 45 OF 61 d) The ideas, concepts, know-how, or techniques relating to data processing, developed during the course of this Contract by the Contractor or jointly by the Contractor and the State, may be used by either party without obligation of notice or accounting. e) This Contract shall not preclude the Contractor from developing materials outside this Contract that are competitive, irrespective of their similarity to materials which might be delivered to the State pursuant to this Contract. 30. SOFTWARE LICENSE: A Service may require the use of Software Products to facilitate use of the Service. Unless otherwise specified in the Statement of Work, the Contractor hereby grants to the State and the State accepts from the Contractor, subject to the terms and conditions of this Contract, a royalty- free, non-exclusive license to use the Software Products in this Contract. The State may use the Software Products only in connection with use of the Service and according to any licensing terms if specified in a Statement of Work or otherwise in the Contract. Acceptance of Software (including third party Software) will be governed by the terms and conditions of this Contract. 31. PROTECTION OF PROPRIETARY SOFTWARE AND OTHER PROPRIETARY DATA: a) The State agrees that all material appropriately marked or identified in writing as proprietary and furnished hereunder by the Contractor are provided for the State’s exclusive use for the purposes of this Contract only. All such proprietary data shall remain the property of the Contractor. The State agrees to take all reasonable steps to ensure that such proprietary data are not disclosed to others, without prior written consent of the Contractor, subject to the California Public Records Act, or other lawful process (e.g., in response to a subpoena); b) The State will ensure, prior to disposing of any media, that any licensed materials contained thereon have been erased or otherwise destroyed; and c) The State agrees that it will take appropriate action by instruction, agreement or otherwise with its employees or other persons permitted access to proprietary data to satisfy its obligations in this Contract with respect to use, copying, modification, protection and security of proprietary materials and data, subject to the California Public Records Act and other applicable law. 32. FUTURE RELEASES: Unless otherwise specifically provided in the Statement of Work, if improved versions (e.g., patches, bug fixes, updates or releases) or upgrades of any SaaS versions or Software Product are developed by the Contractor, and are made available to other customers, they will be made available to the State at no additional cost only if such are made available to other customers at no additional cost. 33. ENCRYPTION AND AUTHORIZATION KEYS: Upon initiation of Service, Contractor will provide all encryption and authorization keys required by the State to operate or access the Software Products or Services. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 62 of 103 CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) STATE MODEL CLOUD COMPUTING SERVICES SPECIAL PROVISIONS (Software as a Service) REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 46 OF 61 34. PATENT, COPYRIGHT AND TRADE SECRET INDEMNITY: a) Contractor will indemnify, defend, and save harmless the State, its officers, agents, and employees, from any and all third party claims, costs (including without limitation reasonable attorneys’ fees), and losses for infringement or violation of any U.S. Intellectual Property Right by any product or service provided hereunder. With respect to claims arising from Software manufactured by a third party and sold by Contractor as a reseller, Contractor will pass through to the State such indemnity rights as it receives from such third party (“Third Party Obligation”) and will cooperate in enforcing them; provided that if the third party manufacturer fails to honor the Third Party Obligation, Contractor will provide the State with indemnity protection equal to that called for by the Third Party Obligation, but in no event greater than that called for in the first sentence of this Section). Unless a Third Party Obligation provides otherwise, the defense and payment obligations set forth in this Section will be conditional upon the following: i. The State will notify the Contractor of any such claim in writing and tender the defense thereof within a reasonable time; and ii. The Contractor will have sole control of the defense of any action on such claim and all negotiations for its settlement or compromise; provided that when substantial principles of government or public law are involved, when litigation might create precedent affecting future State operations or liability, or when involvement of the State is otherwise mandated by law, the State may participate in such action at its own expense with respect to attorneys’ fees and costs (but not liability); (b) where a settlement would impose liability on the State, affect principles of California government or public law, or impact the authority of the State, the Department of General Services or the Department of Technology, as applicable, will have the right to approve or disapprove any settlement or compromise, which approval will not unreasonably be withheld or delayed; and (c) the State will reasonably cooperate in the defense and in any related settlement negotiations. b) Should the Software Products or Services, or the operation thereof, become, or in the Contractor's opinion are likely to become, the subject of a claim of infringement or violation of a U.S. Intellectual Property Right, the State shall, subject to prior approval, permit the Contractor, at its option and expense, either to procure for the State the right to continue using the Services, or to replace or modify the same so that they become non-infringing. If none of these options can reasonably be taken, or if the use of such Services by the State shall be prevented by injunction, the State shall then have the option of terminating this Contract, or applicable portions thereof, without penalty or termination charge and the Contractor shall refund any sums the State has paid the Contractor less any reasonable amount for use or damage. c) The Contractor shall have no liability to the State under any provision of this clause with respect to any claim of patent, copyright or trade secret infringement which is based upon: i. The combination or utilization of Deliverables furnished hereunder with Goods or Software not made or furnished by the Contractor; or ii. The combination or utilization of Software or Services not made or furnished by the Contractor, and introduced into the States computing environment; or iii. The modification initiated by the State, or a third party at the State’s direction, of any Software or Service furnished hereunder; or DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 63 of 103 CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) STATE MODEL CLOUD COMPUTING SERVICES SPECIAL PROVISIONS (Software as a Service) REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 47 OF 61 iv. The combination or utilization of Software furnished hereunder with non- Contractor supplied Software. d) The Contractor certifies that it has appropriate systems and controls in place to ensure that State funds will not be used in the performance of this Contract for the acquisition, operation or maintenance of Software in violation of any U.S. Intellectual Property laws. 35. DISPUTES: a) The parties shall deal in good faith and attempt to resolve potential disputes informally. If the dispute persists, the Contractor shall submit to the contracting Department Director or designee a written demand for a final decision regarding the disposition of any dispute between the parties arising under, related to or involving this Contract. Contractor’s written demand shall be fully supported by factual information, and if such demand involves a cost adjustment to the Contract, the Contractor shall include with the demand a written statement signed by an authorized person indicating that the demand is made in good faith, that the supporting data are accurate and complete and that the amount requested accurately reflects the Contract adjustment for which Contractor believes the State is liable. The contracting Department Director or designee shall have 30 days after receipt of Contractor’s written demand invoking this Section “Disputes” to render a written final decision. If a written decision is not rendered within 30 days after receipt of the Contractor’s demand, it shall be deemed a final decision adverse to the Contractor’s contention. b) Pending the final resolution of any dispute arising under, related to or involving this Contract, Contractor agrees to diligently proceed with the performance of this Contract, including the delivery of Goods or providing of Services in accordance with the State’s instructions regarding this Contract. Contractor’s failure to diligently proceed in accordance with the State’s instructions regarding this Contract shall be considered a material breach of this Contract. c) Any final decision of the State shall be expressly identified as such, shall be in writing, and shall be signed by the contracting Department Director, or designee. The State’s final decision shall be conclusive and binding regarding the dispute unless the Contractor commences an action in a court of competent jurisdiction to contest such decision within 90 days following the date of the final decision or 1 year following the accrual of the cause of action, whichever is later. d) For disputes involving purchases made by the Department of General Services, Procurement Division, the Contractor shall submit to the Department Director or designee a written demand for a final decision, which shall be fully supported in the manner described in subsection a) above. The Department Director or designee shall have 30 days to render a final decision. If a final decision is not rendered within 30 days after receipt of the Contractor’s demand, it shall be deemed a final decision adverse to the Contractor’s contention. The final decision shall be conclusive and binding regarding the dispute unless the Contractor commences an action in a court of competent jurisdiction to contest such decision within 90 days following the date of the final decision or 1 year following the accrual of the cause of action, whichever is later. e) The dates of decision in this section may be modified by mutual consent, as applicable, excepting the time to commence an action in a court of competent jurisdiction. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 64 of 103 CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) STATE MODEL CLOUD COMPUTING SERVICES SPECIAL PROVISIONS (Software as a Service) REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 48 OF 61 36. STOP WORK: a) The State may, at any time, by written Stop Work Order to the Contractor, require the Contractor to stop all, or any part, of the called for by this Contract in the Statement of Work for a period up to 45 days after the Stop Work Order is delivered to the Contractor, and for any further period to which the parties may agree. The Stop Work Order shall be specifically identified as such and shall indicate it is issued under this clause. Upon receipt of the Stop Work Order, the Contractor shall immediately comply with its terms and take all reasonable steps to minimize the incurrence of costs allocable to the work covered by the Stop Work Order during the period of work stoppage. Within a period of 45 days after a Stop Work Order is delivered to the Contractor, or within any extension of that period to which the parties shall have agreed, the State shall either: i. Cancel the Stop Work Order; or ii. Terminate the work covered by the Stop Work Order as provided for in the Termination for Default or the Termination for Convenience clause of this Contract. b) If a Stop Work Order issued under this clause is canceled or the period of the Stop Work Order or any extension thereof expires, the Contractor shall resume work. The State shall make an equitable adjustment in the delivery schedule, the Contract price, or both, and the Contract shall be modified, in writing, accordingly, if: i. The Stop Work Order results in an increase in the time required for, or in the Contractor’s cost properly allocable to the performance of any part of this Contract; and ii. The Contractor asserts its right to an equitable adjustment within 60 days after the end of the period of work stoppage; provided, that if the State decides the facts justify the action, the State may receive and act upon a proposal submitted at any time before final payment under this Contract. c) If a Stop Work Order is not canceled and the work covered by the Stop Work Order is terminated in accordance with the provision entitled Termination for the Convenience of the State, the State shall allow reasonable costs resulting from the Stop Work Order in arriving at the termination settlement. d) The State shall not be liable to the Contractor for loss of profits because of a Stop Work Order issued under this clause. 37. EXAMINATION AND AUDIT: The Contractor agrees that the State or its designated representative shall have the right to review and copy any records and supporting documentation directly pertaining to performance of this Contract. The Contractor agrees to maintain such records for possible audit for a minimum of three years after final payment, unless a longer period of records retention is stipulated. The Contractor agrees to allow the auditor(s) access to such records during normal business hours and in such a manner so as to not interfere unreasonably with normal business activities and to allow interviews of any employees or others who might reasonably have information related to such records. Further, the Contractor agrees to include a similar right of the State to audit records and interview staff in any subcontract related to performance of this Contract. The State shall provide reasonable advance written notice of such audit(s) to the Contractor. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 65 of 103 CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) STATE MODEL CLOUD COMPUTING SERVICES SPECIAL PROVISIONS (Software as a Service) REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 49 OF 61 38. FOLLOW-ON CONTRACTS: a) If the Contractor or its affiliates provides Technical Consulting and Direction (as defined below), the Contractor and its affiliates: i. will not be awarded a subsequent Contract to supply the service or system, or any significant component thereof, that is used for or in connection with any subject of such Technical Consulting and Direction; and ii. will not act as consultant to any person or entity that does receive a Contract described in subsection (i). This prohibition will continue for one year after termination of this Contract or completion of the Technical Consulting and Direction, whichever comes later. b) “Technical Consulting and Direction” means services for which the Contractor received compensation from the State and includes: i. development of or assistance in the development of work statements, specifications, solicitations, feasibility studies, or project approval documentation; ii. development or design of test requirements; iii. evaluation of test data; iv. direction of or evaluation of another Contractor; v. provision of formal recommendations regarding the acquisition of Information Technology products or services; or vi. provisions of formal recommendations regarding any of the above. For purposes of this Section, “affiliates” are employees, directors, partners, joint venture participants, parent corporations, subsidiaries, or any other entity controlled by, controlling, or under common control with the Contractor. Control exists when an entity owns or directs more than 50 percent of the outstanding shares or securities representing the right to vote for the election of directors or other managing authority. c) To the extent permissible by law, the Director of the Department of General Services, or designee, may waive the restrictions set forth in this Section by written notice to the Contractor if the Director determines their application would not be in the State’s best interest. Except as prohibited by law, the restrictions of this Section will not apply: i. to follow-on advice given by vendors of commercial off-the-shelf products, including Software and Hardware, on the operation, integration, repair, or maintenance of such products after sale; or ii. where the State has entered into a master agreement for Software or services and the scope of work at the time of Contract execution expressly calls for future recommendations among the Contractor’s own products. d) The restrictions set forth in this Section are in addition to conflict of interest restrictions imposed on public contractors by California law (“Conflict Laws”). In the event of any inconsistency, such Conflict Laws override the provisions of this Section, even if enacted after execution of this Contract. 39. PRIORITY HIRING CONSIDERATIONS: If this Contract includes services in excess of $200,000, the Contractor shall give priority consideration in filling vacancies in positions funded by the Contract to qualified recipients of aid under Welfare and Institutions Code section 11200 in accordance with PCC section 10353. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 66 of 103 CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) STATE MODEL CLOUD COMPUTING SERVICES SPECIAL PROVISIONS (Software as a Service) REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 50 OF 61 40. COVENANT AGAINST GRATUITIES: The Contractor warrants that no gratuities (in the form of entertainment, gifts, or otherwise) were offered or given by the Contractor, or any agent or representative of the Contractor, to any officer or employee of the State with a view toward securing the Contract or securing favorable treatment with respect to any determinations concerning the performance of the Contract. For breach or violation of this warranty, the State shall have the right to terminate the Contract, either in whole or in part and any loss or damaged sustained by the State in procuring on the open market any items which the Contractor agreed to supply shall be borne and paid for by the Contractor. The rights and remedies of the State provided in this clause shall not be exclusive and are in addition to any other rights and remedies provided in law or equity. 41. NONDISCRIMINATION CLAUSE: a) During the performance of this Contract, the Contractor and its subcontractors shall not unlawfully discriminate, harass or allow harassment, against any employee or applicant for employment because of sex, sexual orientation, race, color, ancestry, religious creed, national origin, disability (including HIV and AIDS), medical condition (cancer), age, marital status, and denial of family care leave. The Contractor and subcontractors shall ensure that the evaluation and treatment of their employees and applicants for employment are free from such discrimination and harassment. The Contractor and subcontractors shall comply with the provisions of the Fair Employment and Housing Act (Government Code, section 12990 et seq.) and the applicable regulations promulgated thereunder (California Code of Regulations, Title 2, section 7285.0 et seq.). The applicable regulations of the Fair Employment and Housing Commission implementing Government Code section 12990 (a-f), set forth in Chapter 5 of Division 4 of Title 2 of the California Code of Regulations are incorporated into this Contract by reference and made a part hereof as if set forth in full. The Contractor and its subcontractors shall give written notice of their obligations under this clause to labor organizations with which they have a collective bargaining or other agreement; and b) The Contractor shall include the nondiscrimination and compliance provisions of this clause in all subcontracts to perform work under the Contract. 42. NATIONAL LABOR RELATIONS BOARD CERTIFICATION: The Contractor swears under penalty of perjury that no more than one final, unappealable finding of contempt of court by a federal court has been issued against the Contractor within the immediately preceding two-year period because of the Contractor’s failure to comply with an order of the National Labor Relations Board. This provision is required by, and shall be construed in accordance with, PCC section 10296. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 67 of 103 CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) STATE MODEL CLOUD COMPUTING SERVICES SPECIAL PROVISIONS (Software as a Service) REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 51 OF 61 43. ASSIGNMENT OF ANTITRUST ACTIONS: Pursuant to Government Code sections 4552, 4553, and 4554, the following provisions are incorporated herein: a) In submitting a bid to the State, the supplier offers and agrees that if the bid is accepted, it will assign to the State all rights, title, and interest in and to all causes of action it may have under section 4 of the Clayton Act (15 U.S.C. 15) or under the Cartwright Act (Chapter 2, commencing with section 16700, of Part 2 of Division 7 of the Business and Professions Code), arising from purchases of Goods, material or other items, or services by the supplier for sale to the State pursuant to the solicitation. Such assignment shall be made and become effective at the time the State tender’s final payment to the supplier; b) If the State receives, either through judgment or settlement, a monetary recovery for a cause of action assigned under this chapter, the assignor shall be entitled to receive reimbursement for actual legal costs incurred and may, upon demand, recover from the State any portion of the recovery, including treble damages, attributable to overcharges that were paid by the assignor but were not paid by the State as part of the bid price, less the expenses incurred in obtaining that portion of the recovery; and c) Upon demand in writing by the assignor, the assignee shall, within one year from such demand, reassign the cause of action assigned under this part if the assignor has been or may have been injured by the violation of law for which the cause of action arose and: i. the assignee has not been injured thereby, or ii. the assignee declines to file a court action for the cause of action. 44. DRUG-FREE WORKPLACE CERTIFICATION: The Contractor certifies under penalty of perjury under the laws of the State of California that the Contractor will comply with the requirements of the Drug-Free Workplace Act of 1990 (Government Code section 8350 et seq.) and will provide a drug-free workplace by taking the following actions: a) Publish a statement notifying employees that unlawful manufacture, distribution, dispensation, possession, or use of a controlled substance is prohibited and specifying actions to be taken against employees for violations, as required by Government Code section 8355(a); b) Establish a Drug-Free Awareness Program as required by Government Code section 8355(b) to inform employees about all of the following: i. the dangers of drug abuse in the workplace; ii. the person's or organization's policy of maintaining a drug-free workplace; iii. any available counseling, rehabilitation and employee assistance programs; and, iv. penalties that may be imposed upon employees for drug abuse violations. c) Provide, as required by Government Code section 8355(c), that every employee who works on the proposed or resulting Contract: i. will receive a copy of the company's drug-free policy statement; and ii. will agree to abide by the terms of the company's statement as a condition of employment on the Contract. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 68 of 103 CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) STATE MODEL CLOUD COMPUTING SERVICES SPECIAL PROVISIONS (Software as a Service) REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 52 OF 61 45. FOUR-DIGIT DATE COMPLIANCE: Contractor warrants that it will provide only Four-Digit Date Compliant (as defined below) Deliverables and Services to the State. “Four-Digit Date Compliant” Deliverables and Services can accurately process, calculate, compare, and sequence date data, including without limitation date data arising out of or relating to leap years and changes in centuries. This warranty and representation is subject to the warranty terms and conditions of this Contract and does not limit the generality of warranty obligations set forth elsewhere herein. 46. SWEATFREE CODE OF CONDUCT: a) Contractor declares under penalty of perjury that no equipment, materials, or supplies furnished to the State pursuant to the Contract have been produced in whole or in part by sweatshop labor, forced labor, convict labor, indentured labor under penal sanction, abusive forms of child labor or exploitation of children in sweatshop labor, or with the benefit of sweatshop labor, forced labor, convict labor, indentured labor under penal sanction, abusive forms of child labor or exploitation of children in sweatshop labor. The Contractor further declares under penalty of perjury that they adhere to the Sweat free Code of Conduct as set forth on the California Department of Industrial Relations website located at www.dir.ca.gov, and Public Contract Code section 6108; and b) The Contractor agrees to cooperate fully in providing reasonable access to its records, documents, agents or employees, or premises if reasonably required by authorized officials of the State, the Department of Industrial Relations, or the Department of Justice to determine the Contractor’s compliance with the requirements under paragraph (a). 47. RECYCLED CONTENT REQUIREMENTS: The Contractor shall certify in writing under penalty of perjury, the minimum, if not exact, percentage of post-consumer material (as defined in the PCC section 12200-12209), in products, materials, goods, or supplies offered or sold to the State that fall under any of the statutory categories regardless of whether the product meets the requirements of Section 12209. The certification shall be provided by the contractor, even if the product or good contains no post- consumer recycled material, and even if the post-consumer content is unknown. With respect to printer or duplication cartridges that comply with the requirements of section 12156(e), the certification required by this subdivision shall specify that the cartridges so comply (PCC 12205 (b)(2)). A state agency contracting officer may waive the certification requirements if the percentage of post-consumer material in the products, materials, goods, or supplies can be verified in a written advertisement, including, but not limited to, a product label, a catalog, or a manufacturer or vendor Internet web site. Contractors are to use, to the maximum extent economically feasible in the performance of the contract work, recycled content products (PCC 12203(d)). DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 69 of 103 CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) STATE MODEL CLOUD COMPUTING SERVICES SPECIAL PROVISIONS (Software as a Service) REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 53 OF 61 48. CHILD SUPPORT COMPLIANCE ACT: For any Contract in excess of $100,000, the Contractor acknowledges in accordance with PCC section 7110, that: a) The Contractor recognizes the importance of child and family support obligations and shall fully b) comply with all applicable State and federal laws relating to child and family support enforcement, including, but not limited to, disclosure of information and compliance with earnings assignment orders, as provided in Chapter 8 (commencing with section 5200) of Part 5 of Division 9 of the Family Code; and c) The Contractor, to the best of its knowledge is fully complying with the earnings assignment orders of all employees and is providing the names of all new employees to the New Hire Registry maintained by the California Employment Development Department. 49. AMERICANS WITH DISABILITIES ACT AND PUBLIC WEBSITE ACCESSIBILITY a) The Contractor assures the State that the Contractor complies with the Americans with Disabilities Act of 1990 (42 U.S.C. 12101 et seq.). The State is responsible for ensuring that public websites are accessible to both the general public and that internal electronic and Information Technology systems are accessible by state employees, including persons with disabilities. Contractor shall assist the State in meeting its responsibilities. b) In accordance with Cal. Gov. Code section 7405(b), the Contractor shall have an ongoing obligation to promptly respond to and resolve any complaint regarding accessibility of its electronic and Information Technology products and Services that is brought to the attention of the Contractor, pursuant to Section 7(e) above. 50. ELECTRONIC WASTE RECYCLING ACT OF 2003: The Contractor certifies that it complies with the applicable requirements of the Electronic Waste Recycling Act of 2003, Chapter 8.5, Part 3 of Division 30, commencing with section 42460 of the Public Resources Code. The Contractor shall maintain documentation and provide reasonable access to its records and documents that evidence compliance. 51. USE TAX COLLECTION: In accordance with PCC section 10295.1, the Contractor certifies that it complies with the requirements of section 7101 of the Revenue and Taxation Code. Contractor further certifies that it will immediately advise the State of any change in its retailer’s seller’s permit or certification of registration or applicable affiliate’s seller’s permit or certificate of registration as described in subdivision (a) of PCC section 10295.1. 52. EXPATRIATE CORPORATIONS: Contractor hereby declares that it is not an expatriate corporation or subsidiary of an expatriate corporation within the meaning of PCC sections 10286 and 10286.1, and is eligible to contract with the State. 53. DOMESTIC PARTNERS: For contracts over $100,000 executed or amended after January 1, 2007, the Contractor certifies that the Contractor is in compliance with Public Contract Code section 10295.3. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 70 of 103 CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) STATE MODEL CLOUD COMPUTING SERVICES SPECIAL PROVISIONS (Software as a Service) REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 54 OF 61 54. SMALL BUSINESS PARTICIPATION AND DVBE PARTICIPATION REPORTING REQUIREMENTS: a) If for this Contract the Contractor made a commitment to achieve small business participation, then the Contractor must within 60 days of receiving final payment under this Contract (or within such other time period as may be specified elsewhere in this Contract) report to the awarding department the actual percentage of small business participation that was achieved. (Govt. Code§ 14841.); and b) If for this Contract the Contractor made a commitment to achieve disabled veteran business enterprise (DVBE) participation, then Contractor must within 60 days of receiving final payment under this Contract (or within such other time period as may be specified elsewhere in this Contract) certify in a report to the awarding department: (1) the total amount the prime Contractor received under the Contract; (2) the name and address of the DVBE(s) that participated in the performance of the Contract; (3) the amount each DVBE received from the prime Contractor; (4) that all payments under the Contract have been made to the DVBE; and (5) the actual percentage of DVBE participation that was achieved. A person or entity that knowingly provides false information shall be subject to a civil penalty for each violation. (Mil. & Vets. Code § 999.5(d); Govt. Code § 14841.) 55. LOSS LEADER: It is unlawful for any person engaged in business within this state to sell or use any article or product as a “loss leader” as defined in section 17030 of the Business and Professions Code. (PCC 12104.5(b).). DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 71 of 103 CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) STATE MODEL CLOUD COMPUTING SERVICES SPECIAL PROVISIONS (Infrastructure as a Service and Platform as a Service) REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 55 OF 61 THESE SPECIAL PROVISIONS ARE ONLY TO BE USED FOR INFRASTRUCTURE AS A SERVICE (IaaS) AND PLATFORM AS A SERVICE (PaaS), AS DEFINED BELOW. THESE SPECIAL PROVISIONS ARE TO BE ATTACHED TO THE GENERAL PROVISIONS – INFORMATION TECHNOLOGY AND ACCOMPANIED BY, AT MINIMUM, A STATEMENT OF WORK (SOW) AND SERVICE LEVEL AGREEMENT (SLA). STATE AGENCIES MUST FIRST: A. CLASSIFY THEIR DATA PURSUANT TO THE CALIFORNIA STATE ADMINISTRATIVE MANUAL (SAM) 5305.5; B. CONSIDER THE FACTORS TO BE TAKEN INTO ACCOUNT WHEN SELECTING A PARTICULAR TECHNOLOGICAL APPROACH, IN ACCORDANCE WITH SAM 4981.1, 4983 AND 4983.1 AND THEN; C. MODIFY THESE SPECIAL PROVISIONS THROUGH THE SOW AND/OR SLA TO MEET THE NEEDS OF EACH ACQUISITION. 1. DEFINITIONS: a) “Authorized Persons” means the Service Provider’s employees, Contractors, subcontractors or other agents who need to access the State’s Data to enable the Service Provider to perform the services required. b) “Data Breach” means the unauthorized access that results in the use, disclosure, destruction, modification, loss or theft of the State’s unencrypted Personal Data or Non-Public Data. c) “Individually Identifiable Health Information” means Information that is a subset of health information, including demographic information collected from an individual, and (1) is created or received by a health care provider, health plan, employer or health care clearinghouse; and (2) relates to the past, present or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and (a) that identifies the individual; or (b) with respect to which there is a reasonable basis to believe the information can be used to identify the individual. d) “Infrastructure-as-a-Service” (IaaS) means the capability provided to the consumer is to provision processing, storage, networks and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, deployed application; and possibly limited control of select networking components (e.g., host firewalls). e) “Non-Public Data” means data submitted to the Service Provider’s IaaS or PaaS Service, other than Personal Data, that is not subject to distribution to the public as public information. It is deemed to be sensitive and confidential by the State because it contains information that is exempt by statute, regulation or policy from access by the general public as public information. f) “Personal Data” means data submitted to the Service Provider’s IaaS or PaaS Service that includes information relating to a person that identifies the person by name and has any of the following personally identifiable information (PII): government-issued identification numbers (e.g., Social Security, driver’s license, passport); financial account information, including account number, credit or debit card numbers; or protected health information (PHI) relating to a person. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 72 of 103 CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) STATE MODEL CLOUD COMPUTING SERVICES SPECIAL PROVISIONS (Infrastructure as a Service and Platform as a Service) REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 56 OF 61 g) “Platform-as-a-Service” (PaaS) means the capability provided to the consumer to deploy onto the cloud infrastructure consumer- created or -acquired applications created using programming languages and tools supported by the provider. This capability does not necessarily preclude the use of compatible programming languages, libraries, services and tools from other sources. The consumer does not manage or control the underlying cloud infrastructure, including network, servers, operating systems or storage, but has control over the deployed applications and possibly application hosting environment configurations. h) “Protected Health Information” (PHI) means Individually Identifiable Health Information transmitted by electronic media, maintained in electronic media, or transmitted or maintained in any other form or medium. PHI excludes education records covered by the Family Educational Rights and Privacy Act (FERPA) as amended, 20 U.S.C. 1232g, records described at 20 U.S.C. 1232g(a)(4)(B)(iv) and employment records held by a covered entity in its role as employer. i) “Security Incident” means the potentially unauthorized access to Personal Data or Non- Public Data the Service Provider believes could reasonably result in the use, disclosure or theft of the State’s unencrypted Personal Data or Non-Public Data within the possession or control of the Service Provider. A Security Incident may or may not turn into a Data Breach. j) “Service Level Agreement” (SLA) means a written agreement between both the State and the Service Provider that is subject to the terms and conditions in this document that unless otherwise agreed to includes (1) the technical service level performance promises, (i.e. metrics for performance and intervals for measure), (2) description of service quality, (3) identification of roles and responsibilities, (4) security responsibilities and notice requirements, how disputes are discovered and addressed, and (6) any remedies for performance failures. k) “Service Provider” means the Contractor, subcontractors, agents, resellers, third parties and affiliates who are providing the services agreed to under the Contract. l) “State Data” means all data created or in any way originating with the State, and all data that is the output of computer processing of or other electronic manipulation of any data that was created by or in any way originated with the State, whether such data or output is stored on the State’s hardware, the Service Provider’s hardware or exists in any system owned, maintained or otherwise controlled by the State or by the Service Provider. m) “State Identified Contact” means the person or persons designated in writing by the State to receive Security Incident or Data Breach notification. n) “Statement of Work” (SOW) means a written statement in a Contract that describes the State’s service needs and expectations. 2. DATA OWNERSHIP: The State will own all right, title and interest in State Data that is related to the services provided by this Contract. The Service Provider shall not access State user accounts or State Data, except in the course of data center operations, (2) in response to service or technical issues, (3) as required by the express terms of this Contract, (4) at the State’s written request or (5) as required by law. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 73 of 103 CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) STATE MODEL CLOUD COMPUTING SERVICES SPECIAL PROVISIONS (Infrastructure as a Service and Platform as a Service) REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 57 OF 61 3. DATA PROTECTION: Protection of personal privacy and data shall be an integral part of the business activities of the Service Provider to ensure there is no inappropriate or unauthorized use of State information at any time. To this end, the Service Provider shall safeguard the confidentiality, integrity and availability of State information within its control and comply with the following conditions: a) In addition to the Compliance with Statues and Regulations provisions set forth in the General Provisions – Information Technology, the Service Provider shall comply as required with: i. The California Information Practices Act (Civil Code Sections 1798 et seq). ii. NIST Special Publication 800-53 Revision 4 or its successor. iii. Privacy provisions of the Federal Privacy Act of 1974. b) All State Data obtained by the Service Provider within its control in the performance of this Contract shall become and remain the property of the State. c) Unless otherwise set forth in the SOW and/or SLA, Personal Data and Non-Public Data shall be encrypted at rest, in use, and in transit with controlled access. The SOW and/or SLA will specify which party is responsible for encryption and access control of the State Data for the service model under Contract. If the SOW and/or SLA and the Contract are silent, then the State is responsible for encryption and access control. d) Unless otherwise set forth in the SOW and/or SLA, it is the State’s responsibility to identify data it deems as Non-Public Data to the Service Provider. The level of protection and encryption for all Non-Public Data shall be identified and made a part of this Contract. e) At no time shall any Personal Data and Non-Public Data or processes — which either belong to or are intended for the use of State or its officers, agents or employees — be copied, disclosed or retained by the Service Provider or any party related to the Service Provider for subsequent use in any transaction without the express written consent of the State except as permitted in Section 2 above. f) (For PaaS Only) Encryption of Data at Rest: The Service Provider shall ensure hard drive encryption consistent with validated cryptography standards as referenced in FIPS 140-2, Security Requirements for Cryptographic Modules for all Personal Data and Non-Public Data, unless the Service Provider presents a justifiable position approved by the State that Personal Data and Non-Public Data must be stored on a Service Provider portable device in order to accomplish work as defined in the SOW and/or SLA. 4. DATA LOCATION: The Service Provider shall provide its services to the State and its end users solely from data centers in the continental United States. Storage of State Data at rest shall be located solely in data centers in the continental United States. The Service Provider shall not allow its personnel or contractors to store State Data on portable devices, including personal computers, except for devices that are used and kept only at its U.S. data centers. The Service Provider shall permit its personnel and contractors to access State Data remotely only as required to provide technical user support or other customer support. The Service Provider may provide technical user support or other customer support on a 24/7 basis using a Follow the Sun model, unless otherwise prohibited in this Contract. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 74 of 103 CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) STATE MODEL CLOUD COMPUTING SERVICES SPECIAL PROVISIONS (Infrastructure as a Service and Platform as a Service) REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 58 OF 61 5. SECURITY INCIDENT OR DATA BREACH NOTIFICATION: The Service Provider shall inform the State of any Security Incident or Data Breach related to State Data within the possession or control of the Service Provider and related to the service provided under this Contract. a) Security Incident Reporting Requirements: Unless otherwise set forth in the SOW and/or SLA, the Service Provider shall promptly report a Security Incident related to its service under the Contract to the appropriate State Identified Contact as defined in the SOW and/or SLA. b) Breach Reporting Requirements: If the Service Provider has actual knowledge of a confirmed Data Breach that affects the security of any State Data that is subject to applicable Data Breach notification law, the Service Provider shall (1) promptly notify the appropriate State Identified Contact within 24 hours or sooner, unless otherwise required by applicable law, and (2) take commercially reasonable measures to address the Data Breach in a timely manner. c) (For PaaS Only) Incident Response: The Service Provider may need to communicate with outside parties regarding a Security Incident, which may include contacting law enforcement, fielding media inquiries and seeking external expertise as mutually agreed upon, defined by law or contained in the contract. Discussing Security Incidents with the State should be handled on an urgent as- needed basis, as part of Service Provider communication and mitigation processes as mutually agreed, defined by law or contained in the Contract. 6. DATA BREACH RESPONSIBILITIES: This section only applies when a Data Breach occurs with respect to Personal Data and/or Non- Public Data within the possession or control of a Service Provider and related to service provided under this Contract. a) The Service Provider, unless otherwise set forth in in the SOW and/or SLA, shall promptly notify the appropriate State Identified Contact within 24 hours or sooner by telephone, unless shorter time is required by applicable law, if it confirms that there is or reasonably believes that there has been a Data Breach. The Service Provider shall (1) cooperate with the State as reasonably requested by the State to investigate and resolve the Data Breach; (2) promptly implement necessary remedial measures, if necessary; and (3) document responsive actions taken related to the Data Breach, including any post-incident review of events and actions taken to make changes in business practices in providing the services, if necessary. b) Service Provider will provide daily updates, or more frequently if required by the State, regarding findings and actions performed by Service Provider to the State Identified Contact until the Data Breach has been effectively resolved to the State’s satisfaction. c) Service Provider shall quarantine the Data Breach, ensure secure access to Data, and repair IaaS and/or PaaS as needed in accordance with the SOW and/or SLA. Failure to do so may result in the State exercising its options for assessing damages or other remedies under this Contract. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 75 of 103 CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) STATE MODEL CLOUD COMPUTING SERVICES SPECIAL PROVISIONS (Infrastructure as a Service and Platform as a Service) REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 59 OF 61 d) Unless otherwise set forth in the SOW and/or SLA, if a Data Breach is a direct result of the Service Provider’s breach of its Contract obligation to encrypt Personal Data and/or Non-Public Data or otherwise prevent its release, the Service Provider shall bear the costs associated with (1) the investigation and resolution of the Data Breach; (2) notifications to individuals, regulators or others required by State law; (3) a credit monitoring service required by State (or Federal) law; (4) a website or a toll-free number and call center for affected individuals required by State law; and (5) complete all corrective actions as reasonably determined by the Service Provider based on root cause; all [(1) through (5)] subject to this Contract’s Limitation of Liability provision as set forth in the General Provisions – Information Technology. 7. NOTIFICATION OF LEGAL REQUESTS: Unless otherwise required by law, the Service Provider shall contact the State upon receipt of any electronic discovery, litigation holds, discovery searches and expert testimonies related to the State’s Data under this Contract, or which in any way might reasonably require access to State’s Data. The Service Provider shall not respond to subpoenas, service of process and other legal requests related to the State without first notifying the State, unless prohibited by law from providing such notice. Unless otherwise required by law, Service Provider agrees to provide its intended responses to the State with adequate time for the State to review, revise and, if necessary, seek a protective order in a court of competent jurisdiction. Service Provider shall not respond to legal requests directed at the State unless authorized in writing to do so by the State. 8. DATA PRESERVATION AND RETRIEVAL: a) For 90 days prior to the expiration date of this Contract, or upon notice of termination of this Contract, Service Provider shall assist the State in extracting and/or transitioning all State Data in the format determined by the State (“Transition Period”). b) The Transition Period may be modified in the SOW and/or SLA or as agreed upon in writing by the parties in a Contract amendment. c) During the Transition Period, IaaS and/or PaaS and State Data access shall continue to be made available to the State without alteration. d) Service Provider agrees to compensate the State for damages or losses the State incurs as a result of Service Provider’s failure to comply with this section in accordance with the “Limitation of Liability” provision set forth in the General Provisions - Information Technology. e) The State at its option, may purchase additional transition services as agreed upon in the SOW and/or SLA. f) During any period of suspension, the Service Provider shall not take any action to intentionally erase any State Data. g) The Service Provider will impose no additional fees for access and retrieval of State Data by the State during the Transition Period. h) After termination of the Contract and the prescribed retention period, the Service Provider shall securely dispose of all State Data in all forms. State Data shall be permanently deleted and shall not be recoverable, according to NIST-approved methods. Certificates of destruction shall be provided to the State. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 76 of 103 CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) STATE MODEL CLOUD COMPUTING SERVICES SPECIAL PROVISIONS (Infrastructure as a Service and Platform as a Service) REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 60 OF 61 9. BACKGROUND CHECKS: As permitted or required by law, the Service Provider shall conduct criminal background checks and not utilize any staff, including subcontractors, to fulfill the obligations of the Contract who have been convicted of any crime of dishonesty, including but not limited to criminal fraud, or otherwise convicted of any felony or any misdemeanor offense for which incarceration for up to 1 year is an authorized penalty. The Service Provider shall promote and maintain an awareness of the importance of securing the State’s information among the Service Provider’s employees and agents. 10. ACCESS TO SECURITY LOGS AND REPORTS: a) (For IaaS Only) Upon request, the Service Provider shall provide reports to the State directly related to the infrastructure the Service Provider controls upon which the State account resides. Unless otherwise agreed to in the SLA, the Service Provider shall provide the State a history of all Application Program Interface (API) calls for the State account that includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters and the response elements returned by the Service Provider. The report will be sufficient to enable the State to perform security analysis, resource change tracking and compliance auditing. b) (For PaaS Only) Upon request, the Service Provider shall provide reports to the State in a format as specified in the SOW and/or SLA and agreed to by both the Service Provider and the State. Reports will include latency statistics, user access, user access IP address, user access history and security logs for all State files related to this Contract. c) The Service Provider and the State recognize that security responsibilities are shared. The Service Provider is responsible for providing a secure infrastructure. The State is responsible for its secure guest operating system, firewalls and other logs captured within the guest operating system. Specific shared responsibilities are identified within the SOW and/or SLA. 11. CONTRACT AUDIT: The Service Provider shall allow the State to audit conformance to the Contract terms. The State may perform this audit or Contract with a third party at its discretion and at the State’s expense. 12. DATA CENTER AUDIT: The Service Provider shall undergo an annual Statement on Standards for Attestation Engagements (SSAE) No. 16 Service Organization Control (SOC) 2 Type II audit of its data centers, or its successor at its own expense. The Service Provider shall provide a redacted version of the audit report and Contractor’s plan to correct any negative findings upon request. The Service Provider may remove its proprietary information from the redacted version. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 77 of 103 CALIFORNIA MULTIPLE AWARD SCHEDULES (CMAS) STATE MODEL CLOUD COMPUTING SERVICES SPECIAL PROVISIONS (Infrastructure as a Service and Platform as a Service) REVISED AND EFFECTIVE JANUARY 20, 2022 PAGE 61 OF 61 13. CHANGE CONTROL AND ADVANCE NOTICE: The Service Provider shall give advance notice (as agreed to by the parties and included in the SOW and/or SLA) to the State of any upgrades (e.g., major upgrades, minor upgrades, system changes) that is expected to materially and negatively impact service availability and performance, as well as any planned downtime for such upgrades. A major upgrade is a replacement of hardware, software or firmware ware with a newer or better version in order to bring the system up to date or to improve its characteristics. It usually includes a new version number. Service Provider may change the features and functionality of the services, without degrading them, to make improvements, address security requirements and comply with changes in law. 14. SECURITY PROCESSES: The Service Provider shall disclose its non-proprietary security processes and technical limitations to the State such that adequate protection and flexibility can be attained between the State and the Service Provider. The State and the Service Provider shall understand each other’s roles and responsibilities, which shall be set forth in the SOW and/or SLA. 15. IMPORT AND EXPORT OF DATA: The State shall have the ability to import or export data in whole or in part at its discretion without interference from the Service Provider. This includes the ability for the State to import or export data to or from other Service Providers. 16. RESPONSIBILITIES AND UPTIME GUARANTEE: The Service Provider shall be responsible for the acquisition and operation of all hardware, software and network support related to the services being provided. The technical and professional activities required for establishing, managing and maintaining the environment are the responsibility of the Service Provider. The system shall be available 24/7/365 (with agreed- upon maintenance downtime), and shall provide service to customers as defined in the SOW and/or SLA. 17. RIGHT TO REMOVE INDIVIDUALS: The State shall have the right at any time to require the Service Provider remove from interaction with State any Service Provider representative who the State believes is detrimental to its working relationship with the Service Provider. The State shall provide the Service Provider with notice of its determination, and the reasons it requests the removal. The Service Provider shall not assign the person to any aspect of the Contract or future work orders without the State’s consent. 18. BUSINESS CONTINUITY AND DISASTER RECOVERY: The Service Provider shall provide a business continuity and disaster recovery plan and shall ensure that it achieves the State’s Recovery Time Objective (RTO), as agreed to by the parties and set forth in the SOW and/or SLA. 19. WEB SERVICES: (For PaaS Only) The Service Provider shall use Web services exclusively to interface with State Data in near real time when possible, or as mutually agreed in the SOW and/or SLA. DocuSign Envelope ID: B8F7F946-29BB-4390-9B30-8AE38D35A96FDocuSign Envelope ID: 655A9EA1-DD18-4D8F-BE56-459C7B232724 Dec. 6, 2022 Item #5 Page 78 of 103 RESOLUTION NO. 2022-271 A RESOLUTION OF THE CITY COUNCIL OF THE CITY OF CARLSBAD, CALIFORNIA, AUTHORIZING THE CITY MANAGER TO EXECUTE A SUBSCRIPTION AND SERVICE AGREEMENT WITH PROCORE TECHNOLOGIES, INC FOR THE USE OF PROCORE PROJECT MANAGEMENT PRO SOFTWARE WITH NO COST ASSOCIATED WITH THE AGREEMENT FOR THE INITIAL TERM AND AUTHORIZING THE CITY MANAGER TO EXECUTE EXTENSIONS AND AMENDMENTS, IF APPROPRIATE WHEREAS, the City Council of the City of Carlsbad, California has determined that the most effective way to operate and support the City of Carlsbad's project management requirements is with Procore Project Management Pro Software; and WHEREAS, the City of Carlsbad currently does not have a project management solution in place and Procore Project Management Pro Software will be the solution chosen from a citywide requirement gathering process; and WHEREAS, in order for the City of Carlsbad to use Procore Project Management Pro Software the City of Carlsbad is required to sign at no cost with Procore Technologies a subscription and service agreement for the project management solution in conjunction with a supplemental terms and conditions agreement with EC America, Inc for implementation, licensing and subscription services; and WHEREAS, the city manager will have the authority to execute the subscription and service agreement with Procore Technologies and, if required, to execute extensions and amendments to the agreement; WHEREAS, all cost associated with the use of Procore Project Management Pro Software are included with the EC America, Inc supplemental terms and conditions agreement for implementation, licensing and subscription services of Procore Project Management Pro Software. NOW, THEREFORE, BE IT RESOLVED by the City Council of the City of Carlsbad, California, as follows: 1.That the above recitations are true and correct. 2.That the subscription and service agreement with Procore Technologies (Attachment A) is approved and the City Manager is authorized to execute all required documents on behalf of the city including possible extension and amendments for four one-year terms. Exhibit 2 Dec. 6, 2022 Item #5 Page 79 of 103 3.That there is no cost for the subscription and service agreement with Procore Technologies, Inc. and all cost associated with the use of Procore Project Management Pro Software are included with the EC America, Inc supplemental terms and conditions agreement for implementation, licensing and subscription services for the initial term ending one year from the date the agreement is signed: PASSED, APPROVED AND ADOPTED at a Regular Meeting of the City Council of the City of Carlsbad on the 6th day of December, 2022, by the following vote, to wit: AYES: NAYS: ABSENT: Blackburn, Bhat-Patel, Acosta, Norby. None. Hall. � or MATT HALL, Mayor � /¥1../FAVIOLA MEDINA, City Clerk Services Manager "f -(SEAL) Dec. 6, 2022 Item #5 Page 80 of 103 Procore_SSA_Rev 2022.01.10 Page 1 of 21 PROCORE SUBSCRIPTION AND SERVICES AGREEMENT This Subscription and Services Agreement, including any Orders and SOWs, (“Agreement”) is entered into as of the date of the last signature below (the “Effective Date”) between the applicable Procore contracting entity set forth in Section 11.5 (“Procore”) and the City of Carlsbad, with offices at 1635 Faraday Ave, Carlsbad, CA 92008 (“Customer”). Procore and Customer may also be referred to herein individually as “Party” or together as the “Parties.” Capitalized terms used but not otherwise defined herein have the respective meanings designated in Section 12. The Parties hereby agree as follows: 1.PROVISION OF SERVICES 1.1. Access to Subscription Services. Subject to Customer’s compliance with this Agreement and timely payment of applicable Fees, during the Subscription Term, Procore shall make the Subscription Services available to Customer for Customer’s internal business use in accordance with the Usage Metrics purchased by Customer. Customer agrees that its purchase and use of the Subscription Services are not contingent on any future functionality or features, or dependent on any oral or written statements made by Procore or any of its Affiliates regarding future functionality or features. 1.2. Evolving Procore Technology. Subject to Section 7.2(b), Procore may issue Updates for the Services during the Subscription Term. 1.3. Protection of Customer Data. Procore shall maintain administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of Customer Data. Where Customer’s use of the Services includes the processing of “personal data” subject to applicable data protection laws, such use will be governed by the data processing addendum (“DPA”) that is incorporated into this Agreement. Customer shall only provide to Procore the minimum amount of personal data necessary to enable Customer to use the Services in accordance with this Agreement. 1.4. Beta Services. From time to time, Procore may invite Customer and Authorized Users to participate in a program regarding certain pre-release or beta services (collectively, “Beta Services”). Customer may accept or decline to participate in any Beta Services. Any services designated by Procore as Beta Services (e.g., “beta,” “pilot,” “limited release,” “developer preview,” “non-production evaluation,” or other similar designation) are solely for Customer’s evaluation purposes. If Customer opts into a Beta Service, Customer agrees to participate in usage and other testing and provide Feedback) about such Beta Service, as reasonably requested by Procore. Beta Services are not considered Services under this Agreement, are not supported, and may be subject to additional program terms. Unless otherwise stated, any Beta Service evaluation period will expire upon the earlier of one (1) year from the evaluation start date and the date of such Beta Service’s commercial release, unless such Beta Service is earlier discontinued by Procore. Procore may discontinue any Beta Service at any time and may never make such Beta Service generally available. Beta Services are provided “as is,” without express or implied warranty, and without indemnity. Procore and its Affiliates will have no liability for, and Customer hereby fully and irrevocably releases Procore and its Affiliates from, any liability or damage arising out of or in connection with any Beta Service. 2.USE OF SERVICES 2.1. Customer’s Responsibilities. Only Authorized Users are permitted to access and use the Services. Customer acknowledges that Procore may contact Customer and Authorized Users in connection with Procore’s and its Affiliates’ services. Customer shall be solely responsible for (a) Authorized Users’ compliance with this Agreement and any Order(s) issued hereunder; (b) the accuracy and quality of Customer Data, the means by which Customer acquired Customer Data, and obtaining appropriate usage rights with respect to Customer Data; (c) maintaining the confidentiality of usernames, passwords, and other account information or access credentials (as applicable); (d) all activities that occur under its Authorized Users’ usernames, passwords, accounts or access credentials as a result of Authorized Users’ access to the Services; and (e) ensuring Authorized Users’ use the Services only in accordance with the Documentation. Customer shall provide written notice to Authorized Users and/or Data Subjects that Customer Personal Data (as defined in the DPA) is subject to Customer’s own privacy policy and other terms regarding the use or handling of Customer Personal Data in accordance with applicable Data Protection Law. Customer shall provide disclosures to and obtain consents from Authorized Users as required under applicable Data Protection Law in order to share Customer Data. Customer shall notify Procore immediately of any unauthorized use of, or access to, the Services. 2.2. Restrictions. Customer shall not and shall not permit others to (a) make any Services available to any third party other than Customer or Authorized Users; (b) sell, resell, license, sublicense, distribute, rent, or lease any Services, or include any Services in a service bureau or outsourcing offering; (c) use the Services to store or transmit infringing, tortious, libelous, or otherwise unlawful material, Harmful Code, or material that otherwise violates the rights of any DocuSign Envelope ID: D4E4F8D4-84AE-4394-9B6D-BD966564D633DocuSign Envelope ID: 864A4536-2679-4503-9CBA-B8F08B8B945E Attachment A Dec. 6, 2022 Item #5 Page 81 of 103 PRCECRE" Procore_SSA_Rev 2022.01.10 Page 2 of 21 third-party; (d) interfere with or disrupt the integrity or performance of the Services or any third-party data contained therein; (e) use, or permit direct or indirect access to, the Services in a way that seeks to circumvent the Usage Metrics, (f) use the Services to exploit any Procore Intellectual Property Rights except as otherwise expressly permitted under this Agreement, an Order, or the Documentation; (g) frame or mirror any part of the Services, except as permitted by and in accordance with the Documentation; (h) access the Services in order to develop a competitive product or service or benchmark with a non-Procore product or service, or to otherwise exploit for competitive purposes; (i) subject to applicable law, reverse engineer, copy, or modify any software included as part of the Services; (j) use the Services for any improper, fraudulent, or other non-legitimate business purpose; (k) use the Services in a way that could be considered harmful, malicious, threatening, offensive, pornographic, defamatory, bigoted, hateful, indecent, or otherwise objectionable in Procore’s reasonable discretion; (l) use the Services to send unsolicited communications, promotions, or advertisements in violation of the CAN-SPAM Act or any other applicable anti-spam or e-privacy law, rule, or regulation; (m) use any automated device or process, such as a robot, spider, datamining, web-scraping, or other means to circumvent, access, use, or integrate with the Services or its contents, including but not limited to other user account information; (n) damage, interfere, disable, or impair the Services in any way; or (o) use the Service in violation of applicable law. 2.3. Affiliates. Customer’s Affiliates may purchase Services under this Agreement if such Affiliate directly enters into an Order with Procore or its applicable Affiliate, and by doing so such Customer Affiliate agrees to be bound by the terms of this Agreement as if it were an original party hereto. Each Affiliate’s Order(s), and the corresponding Usage Metrics, are separate and distinct from Customer’s and its other Affiliates’ respective Orders and Usage Metrics, unless otherwise set forth on an applicable Order. 3. THIRD-PARTY APPLICATIONS Products or services developed by third parties may be available to Customer, including via Procore’s API, for use with the Services (“Third-Party Applications”). By using Third-Party Applications, Customer permits Procore to grant providers of such Third-Party Applications access to Customer Data or other data as required for the use and support of such Third-Party Applications in conjunction with the Subscription Services. Third-Party Applications are not Services under this Agreement, may be subject to the third-party provider’s additional terms, and may require an additional fee to such providers in order to use the Third-Party Applications. The Procore software may contain features designed to interoperate with Third-Party Applications. Such features are not considered Services under this Agreement. Procore may cease providing such features for any reason, including if the provider of a Third-Party Application ceases to make the Third-Party Application available for interoperation with the Services, without entitling Customer to any refund, credit, or compensation. Notwithstanding any obligations Procore may have under an applicable DPA, Procore is not responsible for the use or protection of Customer Data in any Third-Party Applications. 4. FEES AND PAYMENT 4.1. Fees. Customer shall pay Procore all fees as set forth in the applicable Order or SOW, as well as any Overages (“Fees”). Except as set forth in Section 7.2, all payment obligations are non-cancelable and Fees paid are non-refundable. 4.2. Payment Terms. Except as otherwise set forth in the applicable Order, all Fees will be billed annually in advance. All invoices for Fees, Taxes, and Overages are due and payable within the time frame and in the currency set forth in the applicable Order, without deduction or setoff. Interest on unpaid amounts will accrue from the applicable invoice’s due date at the higher of 1.5% per month and the highest rate allowed by applicable law. Customer is responsible for providing complete and accurate billing and contact information to Procore and promptly notifying Procore of any changes to such information. If Customer fails to pay any undisputed portion of a past due invoice, including accrued interest, within ten (10) business days after receiving notice that its account is overdue, Procore may, without limiting its other rights and remedies, suspend the Services until such amounts are paid in full (“Non- Payment Suspension”). Procore is not obligated to continue to provide Services without payment of applicable Fees. 4.3. Use of Purchase Orders. No terms of any purchase order or other form or agreement provided by Customer will modify or supplement this Agreement, regardless of any failure of Procore to object to such terms, and any such terms will have no force or effect. 4.4. Taxes. Fees and Overages do not include any taxes, tariffs, levies, duties, or similar governmental charges or assessments of any nature, including, value-added, sales, use, or withholding taxes, assessable by any jurisdiction (collectively, “Taxes”). Customer is responsible for paying all Taxes associated with its purchases under this Agreement. If Procore is legally required to pay or collect Taxes for which Customer is responsible under this Section, Procore shall invoice Customer and Customer shall pay such amounts, unless Customer provides Procore with a valid tax exemption certificate authorized by the appropriate taxing authority. For clarity, Procore is solely responsible for taxes assessable against it based on its own income, property, and employees. Unless prohibited by the applicable taxing jurisdiction, the tax situs will be Customer’s ship-to address as set forth in the applicable Order. DocuSign Envelope ID: D4E4F8D4-84AE-4394-9B6D-BD966564D633DocuSign Envelope ID: 864A4536-2679-4503-9CBA-B8F08B8B945E Dec. 6, 2022 Item #5 Page 82 of 103 Procore_SSA_Rev 2022.01.10 Page 3 of 21 4.5. Usage Verification & Subscription Review. Customer acknowledges that Procore or its Affiliates may, at Procore’s expense, review Customer’s use of the Subscription Services for the purpose of verifying Customer’s compliance with this Agreement. Customer shall reasonably cooperate with and assist Procore or its Affiliates, as applicable, in such review and verification of Customer’s Usage Metrics. In addition, but no more than once annually, Procore’s subscription management team may initiate an offsite “Subscription Review” by requesting copies of records evidencing Customer’s Usage Metrics (for example, invoice details, project budgets, contract values, and change orders) and other reasonable substantiation. Customer shall provide such records within fifteen (15) business days, or such other mutually agreeable time frame, of Procore’s written request. Procore may invoice Customer, and Customer shall pay, for any usage of the Services that exceeds the Usage Metrics (“Overages”). Overages will be invoiced at Procore’s then-current standard rates. 4.6. Purchases Through a Reseller. If Customer purchases Services through a Reseller, the pricing and payment terms for such Services are between Customer and Reseller (“Reseller Terms”). Customer acknowledges that (a) all payments for Services procured via a Reseller will be made directly to the Reseller and in accordance with the Reseller Terms; and (b) if a Reseller notifies Procore of its right to terminate or suspend any Services, Procore may terminate or suspend such Services. Procore will not be liable to Customer or any third party for any liabilities, claims, or expenses arising from or relating to any applicable Reseller Terms. 5. PROPRIETARY RIGHTS AND LICENSES 5.1. Ownership; Reservation of Rights. All Procore Intellectual Property Rights, including Intellectual Property Rights in the Services, Beta Services, Documentation, Statistical Usage Data, and Procore’s Confidential Information, are and will remain owned exclusively by Procore and its Affiliates, as applicable. Ownership in all Updates, derivatives, modifications, new functionalities, enhancements, and customization related to the Services created by or on behalf of Procore will immediately vest in Procore upon creation. Unless otherwise specified in an applicable SOW, all deliverables provided in the performance of Professional Services are owned by Procore and will be made available as part of the Subscription Services provided under this Agreement. Nothing in this Agreement will preclude or limit Procore from using or exploiting any concepts, ideas, techniques, or know-how of or related to the Services. Other than as expressly set forth in this Agreement, no license or other rights in or to the Services or other Procore Intellectual Property Rights are granted to Customer, and all such rights are expressly reserved to Procore and its Affiliates. 5.2. Use of Procore Logos. Use of Procore’s logos, and all other Procore trademarks, service marks, product names, and trade names of Procore, is subject to the Procore trademark usage guidelines at www.procore.com/legal/trademark. 5.3. Customer Data. Customer Data and Customer’s Confidential Information are and will remain owned exclusively by Customer or its Authorized Users, as applicable. Customer hereby grants Procore, its Affiliates, and its subprocessors a worldwide right and license to access, host, display, process, analyze, transmit, reproduce, and otherwise utilize Customer Data (subject to Sections 1.3 and 6.2) for the purposes of providing and improving the Services in accordance with this Agreement. 5.4. Statistical Usage Data. Procore and its Affiliates may collect, use, and otherwise process Statistical Usage Data for their own analysis, analytics, marketing, and other internal business purposes, including, without limitation, improving Procore’s products and services. Except where Customer has expressly provided its written consent, Procore will only disclose Statistical Usage Data if such data is (a) aggregated or anonymized; and (b) does not disclose the identity of Customer or its Authorized Users or any Customer Confidential Information. 5.5. Feedback. To the extent that Customer or its Authorized Users provide any recommendations, suggestions, proposals, ideas, improvements, or other feedback regarding the Services or Documentation (“Feedback”), Customer hereby grants Procore an irrevocable, perpetual, royalty-free license to freely use, reproduce, distribute, modify, incorporate, commercially exploit, and further develop such Feedback without any restrictions or attribution. 6. CONFIDENTIALITY 6.1. Definition of Confidential Information. “Confidential Information” means all information or data disclosed by a Party or any of its Affiliates (as applicable, the “Disclosing Party”) that is confidential, proprietary, or otherwise not publicly available, or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure whether oral or in writing, and disclosed during the Term in connection with the Services. Confidential Information includes, (a) with respect to Customer, Customer Data; (b) with respect to Procore, the Services, and the Beta Services, including any discussions or information related to Beta Services; and (c) with respect to a Party, any technical, financial, economic, marketing, strategic, business, product, design, operational, of such Party. Confidential Information does not include any information that (a) is or becomes generally known to the public without breach of this Agreement or any other agreement by the Party receiving information or any of its Affiliates (as applicable, the “Receiving Party”); (b) was known to the Receiving Party prior to its disclosure by the Disclosing DocuSign Envelope ID: D4E4F8D4-84AE-4394-9B6D-BD966564D633DocuSign Envelope ID: 864A4536-2679-4503-9CBA-B8F08B8B945E Dec. 6, 2022 Item #5 Page 83 of 103 Procore_SSA_Rev 2022.01.10 Page 4 of 21 Party without breach of any obligation owed to the Disclosing Party; (c) is received from a third party without restriction on disclosure and without breach of any obligation owed to the Disclosing Party; (d) was independently developed by the Receiving Party without use of or reference to any Confidential Information; or (e) is subject to disclosure under the California Public Records Act, the Civil Discovery Act or other applicable federal or state law. 6.2. Protection of Confidential Information. The Receiving Party shall (a) use the same degree of care that it uses to protect the confidentiality of its own confidential information of like kind (but not less than reasonable care); (b) not use any Confidential Information for any purpose outside the scope of this Agreement; and (c) except as otherwise expressly consented to by an authorized representative of the Disclosing Party, limit access to Confidential Information to those of its and its Affiliates’ employees and contractors who need that access for purposes consistent with this Agreement and who have signed confidentiality agreements with the Receiving Party containing protections no less restrictive than those herein.. 6.3. Compelled Disclosure. The Receiving Party may disclose Confidential Information to the extent compelled by law or legal process to do so, on condition that the Receiving Party gives the Disclosing Party prior notice of the compelled disclosure (to the extent legally permitted) and reasonable assistance, at the Disclosing Party’s cost, if the Disclosing Party wishes to contest the compelled disclosure. If the Receiving Party is compelled by law to disclose Confidential Information as part of a proceeding to which the Disclosing Party is a party, and the Disclosing Party is not contesting the disclosure, the Disclosing Party shall reimburse the Receiving Party for its reasonable cost of compiling and providing secure access to that Confidential Information. 7. REPRESENTATIONS, WARRANTIES, EXCLUSIVE REMEDIES, DISCLAIMERS 7.1. General Warranty. Each Party represents and warrants that it has the necessary rights to enter into this Agreement and has the legal power to do so. 7.2. Procore Limited Warranties. Procore warrants that (a) the Subscription Services will perform materially in accordance with the applicable Documentation; (b) Procore will not materially reduce the core functionality of the Subscription Services during the current Subscription Term; (c) Procore will use industry standard measures to deliver the Subscription Services free of Harmful Code; and (d) Procore will perform the Professional Services in a diligent and professional manner. Customer’s exclusive remedy and Procore’s entire liability for a breach of the above warranties will be, at Procore’s option, (x) the correction of the deficient Service that caused the breach of warranty, or (y) provision of comparable functionality. If Procore cannot accomplish (x) or (y) in a commercially reasonable manner, as determined in its reasonable discretion, Procore may terminate the deficient service and refund to Customer any prepaid Fees for the terminated Service, prorated to cover the remaining portion of the Subscription Term following notice of the breach of warranty. 7.3. Disclaimers. Except as expressly provided herein, neither Party or its licensors makes any warranty of any kind, whether express, implied, statutory, or otherwise, and each Party and its licensors specifically disclaim all implied warranties, including any implied warranty of merchantability, fitness for a particular purpose, title, or non- infringement, to the maximum extent permitted by applicable law. Notwithstanding Procore’s obligations under the DPA, Procore does not warrant that Services will be error-free or uninterrupted, will meet Customer’s requirements or expectations, or that its security measures will be sufficient to prevent third-party access to Customer Data. 8. INDEMNIFICATION 8.1. Indemnification by Procore. (a) Procore shall defend any claim brought against Customer by a third-party to the extent such claim alleges that Customer’s use of the Subscription Services (as authorized in this Agreement, and as provided by Procore to Customer) (1) infringes any valid and enforceable third-party patent, copyright, or registered trademark, or (2) misappropriates a third-party trade secret (a “Claim”). If a third party makes a Claim against Customer, Procore shall pay all damages (including reasonable attorneys’ fees) finally awarded against Customer by a court of competent jurisdiction, or the settlement agreed to by Procore with respect to such Claim. (b) If any Claim is brought or threatened, or if Procore reasonably believes that the Subscription Services may become the subject of a Claim, Procore may, at its sole option and expense (1) procure for Customer the right to continue to use the applicable Subscription Service; (2) modify the Subscription Service to make it non- infringing; (3) replace the affected aspect of the Subscription Service with non-infringing technology having substantially similar capabilities; or (4) if Procore determines none of the foregoing is commercially practicable, terminate this Agreement upon thirty (30) days’ notice and refund Customer any prepaid Fees related to the applicable Subscription Services prorated for the remainder of the Subscription Term. DocuSign Envelope ID: D4E4F8D4-84AE-4394-9B6D-BD966564D633DocuSign Envelope ID: 864A4536-2679-4503-9CBA-B8F08B8B945E Dec. 6, 2022 Item #5 Page 84 of 103 Procore_SSA_Rev 2022.01.10 Page 5 of 21 (c) Procore’s defense and indemnity obligations do not apply to, and Procore will have no liability with respect to, any Claim arising in whole or part due to (1) any modification of the Subscription Services made by anyone other than Procore, (2) any use of the Subscription Services in combination with software, products, or services not provided by Procore, (3) any Third-Party Applications; (4) Services under an Order for which there is no charge; (5) Customer’s use of the Subscription Services not in compliance with this Agreement; or (6) Customer’s failure to use any Update provided by Procore. This indemnity states Procore’s entire liability, and Customer’s exclusive remedy, for any Claims as described in Section 8.1. 8.2. Indemnification by Customer. Customer shall defend any claim brought against Procore by a third party to the extent such claim relates to the Customer Data (if used by Procore in accordance with this Agreement) or Third-Party Applications built by or on behalf of Customer. If a third party makes such a claim against Procore, Customer shall pay all damages (including reasonable attorneys’ fees) finally awarded against Procore or the settlement agreed to by Customer with respect to such claim. This indemnity states Customer’s entire liability, and Procore’s exclusive remedy, for any third-party claims as described in this Section 8.2. 8.3. Procedure. The defense and indemnity obligations above are conditioned upon the indemnified Party providing the indemnifying Party with (a) prompt notice; (b) sole control over the defense and any settlement negotiations; and (c) all information and assistance reasonably requested by the indemnifying Party in connection with the defense or settlement of the indemnifiable claim. The indemnifying Party shall not agree to a settlement that imposes any obligation or liability on the indemnified Party without the indemnified Party’s prior written consent, which will not be unreasonably withheld, conditioned, or delayed. The indemnified Party may appear in connection with such claims, at its own expense, through counsel reasonably acceptable to the indemnifying Party. 9. LIMITATION OF LIABILITY 9.1. Exclusion of Damages. Neither Party nor its respective Affiliates will be liable for any loss of profits, revenues, goodwill, anticipated savings, or use, costs of substitute goods or services, or business interruption, or work stoppage, or any indirect, special, incidental, exemplary, punitive, or consequential damages, however caused, and based on any theory of liability, whether for breach of contract, breach of warranty, tort (including negligence), product liability, or otherwise, even if such Party is advised of the possibility of such damages. The foregoing disclaimer will not apply to the extent prohibited by law. 9.2. Limitation of Liability. A Party’s and its respective Affiliates’ aggregate cumulative liability for all damages arising out of or related to this Agreement will not exceed the applicable Fees paid or payable to Procore in an Order or SOW for the applicable Services and attributable to the twelve (12) month period immediately preceding the event giving rise to the liability. The existence of more than one claim will not expand this limit. The liability limitations under this Section 9.2 will not apply to (a) Customer’s obligations to pay Fees due under this Agreement; (b) Customer’s breach of Sections 2.1 or 2.2; (c) amounts finally determined pursuant to either Party’s indemnity obligations under Section 8; (d) either Party’s gross negligence, willful misconduct, or fraud; or (e) either Party’s negligence on-site during the performance of Professional Services that results in death or personal injury. Nothing in this Agreement excludes or limits any liability that cannot be excluded or limited under applicable law. 10. TERM AND TERMINATION 10.1. Term of Agreement. This Agreement will begin on the Effective Date and continue until terminated as permitted herein (the “Term”). If there are no active Orders, this Agreement may be terminated by either Party upon ninety (90) days’ prior notice. 10.2. Subscription Term. The initial Subscription Term and any applicable renewal Subscription Term will begin and end in accordance with the start date and end date set forth in the Order. Any new Service subsequently added to an existing subscription will be coterminous with the current Subscription Term. 10.3. Suspension. In the event of Customer’s or an Authorized User’s breach of this Agreement, including without limitation for Non-Payment Suspension or violation of the restrictions in Section 2.2, Procore may, in its reasonable discretion, suspend Customer’s or an Authorized User’s access to or use of the Subscription Services. Notwithstanding the foregoing, Procore shall use good-faith, reasonable efforts, unless the circumstances dictate otherwise, to reasonably notify Customer or an Authorized User via email before taking the foregoing actions. 10.4. Termination. Either Party may terminate this Agreement or any Order or SOW upon notice if the other Party is in material breach of this Agreement, where such material breach is not cured (to the extent capable of being cured) within thirty (30) days after receiving notice of breach from the non-breaching Party, or with immediate effect where such material breach cannot be cured. For the avoidance of doubt and without limiting rights of Procore, Customer’s noncompliance with Section 2.2 or Section 4.2 will be deemed a material breach of this Agreement. This Agreement DocuSign Envelope ID: D4E4F8D4-84AE-4394-9B6D-BD966564D633DocuSign Envelope ID: 864A4536-2679-4503-9CBA-B8F08B8B945E Dec. 6, 2022 Item #5 Page 85 of 103 Procore_SSA_Rev 2022.01.10 Page 6 of 21 may be terminated by either Party with immediate effect if the other Party becomes the subject of a petition in bankruptcy or other proceeding relating to insolvency, receivership, liquidation, or assignment for the benefit of creditors, and such petition or proceeding is not dismissed within forty-five (45) days. 10.5. Effect of Termination. Upon the termination of this Agreement for any reason (a) unless otherwise agreed by the Parties in writing, all outstanding Orders and access to the Subscription Services will automatically terminate; (b) Customer and its Authorized Users shall immediately cease access and use of the Subscription Services, other than for retrieval purposes provided in (d); (c) all outstanding payment obligations of Customer will become due and payable immediately; and (d) for thirty (30) days following the termination of this Agreement Procore shall make Customer Data available to Customer, at Customer’s request, via read-only access to the Subscription Service, solely for purpose of allowing Customer to retrieve Customer Data. After thirty (30) days, Procore will have no obligation to maintain or provide any Customer Data, and thereafter may delete or destroy all copies of Customer Data. If Procore is required to retain a copy of Customer Data for legal purposes, such copy remains subject to the confidentiality provisions of this Agreement. 10.6. Refund or Payment upon Termination. If Customer terminates this Agreement due to Procore’s material breach, Procore shall refund Customer the prorated portion of prepaid Fees for unused Services. If Procore terminates this Agreement due to Customer’s material breach, Customer shall pay any unpaid Fees. Termination will not relieve Customer of its obligation to pay any Fees for the period prior to the effective date of termination. 10.7. Surviving Provisions. The Sections titled “Fees and Payment,” “Proprietary Rights and Licenses,” “Confidentiality,” “Representation, Warranties, Exclusive Remedies, Disclaimers,” “Term and Termination,” “Indemnification,” “Limitation of Liability,” and “General Provisions” will survive any termination of this Agreement. 11. GENERAL PROVISIONS 11.1. Publicity & Searchability Options. (a) The Services may contain functionality to allow Customer and third parties to search for one another for various purposes, such as inviting a third party to collaborate on a project, soliciting and/or receiving a bid, etc. Where Procore has made such functionality available, Customer will have the ability to control its visibility for such searches within the Services. 11.2. Export Control. Each Party shall comply with all applicable Export Control and Sanctions Laws and Regulations in connection with providing and using the Services. Without limiting the foregoing, (a) each Party represents that it is not listed on any list of entities or individuals who are restricted from receiving U.S. services or items subject to jurisdiction of U.S. Export Controls (including but not limited to the Specially Designated Nationals and Blocked Persons List and the Entity List) nor is it owned or controlled by any such listed entity; (b) Customer shall not, and shall ensure that Authorized Users do not, violate any Export Control and Sanctions Laws and Regulations, or cause any such violation to occur; and (c) Customer shall not use or cause any person to use the Services to store, retrieve, or transmit technical data controlled under the U.S. International Traffic in Arms Regulations. 11.3. Anti-Corruption. Neither Party has promised, made, or received any bribe, kickback, or other similar payment or transfer of value from or to any director, officer, employee, agent, or other representative of the other Party in connection with this Agreement. Reasonable gifts, entertainment, sponsorships, and donations do not violate the above restriction. 11.4. U.S. Government Rights. If Customer, or any Authorized User, is a branch, agency, or instrumentality of the United States Government, the following provision applies: The Services and Documentation comprise “commercial computer software” and “commercial computer software documentation” as such terms are used in 48 C.F.R. 12.212 and are provided to the Government (a) for acquisition by or on behalf of civilian agencies, consistent with the policy in 48 C.F.R. 12.212; or (b) for acquisition by or on behalf of units of the Department of Defense, consistent with the policies in 48 C.F.R. 227.7202-1 and 22.7202-3. The rights of the U.S. Government to use, commercial computer software, commercial computer software documentation, and technical data furnished in connection with this Agreement are solely as provided in this Agreement. No additional rights are provided to the Government unless set forth in a separate written addendum. DocuSign Envelope ID: D4E4F8D4-84AE-4394-9B6D-BD966564D633DocuSign Envelope ID: 864A4536-2679-4503-9CBA-B8F08B8B945E Dec. 6, 2022 Item #5 Page 86 of 103 Procore_SSA_Rev 2022.01.10 Page 7 of 21 11.5. Contracting Entity, Governing Law & Venue. The Procore contracting entity, law that will apply to a dispute arising out of or relating to this Agreement, and jurisdiction for dispute resolution depend on where Customer is domiciled, in all cases without reference to conflict of law rules of any jurisdiction. If Customer is domiciled in: The Procore contracting entity is: Governing law is that of: The venue for dispute resolution is: California Procore Technologies, Inc. 6309 Carpinteria Ave. Carpinteria, CA 93013 USA California San Diego, California Any U.S. state other than California; Mexico; or a country in Central America, South America, or the Caribbean Procore Technologies, Inc. 6309 Carpinteria Ave. Carpinteria, CA 93013 USA Delaware New Castle County, Delaware Canada Procore Technologies, Inc. 6309 Carpinteria Ave. Carpinteria, CA 93013 USA Ontario Ontario, Canada The United Kingdom; or a country in Europe, Africa, or the Middle East Procore UK Ltd 51 Eastcheap London EC3M 1JP U.K. England London, England Australia or New Zealand Procore Technologies, Inc. 6309 Carpinteria Ave. Carpinteria, CA 93013 USA New South Wales Sydney, New South Wales A country in Asia or the Pacific region other than Australia or New Zealand Procore Technologies, Inc. 6309 Carpinteria Ave. Carpinteria, CA 93013 USA Singapore Singapore The provisions of the United Nations Convention of Contracts for the International Sale of Goods and the Uniform Computer Information Transactions Acts will not apply to this Agreement in any manner whatsoever. 11.6. Dispute Resolution. The Parties shall attempt in good faith to promptly resolve any disputes arising out of or relating to this Agreement by negotiation between representatives of each Party with the authority to resolve such dispute. 11.7. Notices. Notices to Customer will be delivered via email or overnight delivery at the address associated with the Order. Notices to Procore will be delivered via email to legalnotice@procore.com or by overnight delivery to Procore Technologies, Inc., Attention Chief Legal Officer, 6309 Carpinteria Ave., Carpinteria, CA 93013 USA. All notices must be in writing and will be effective when received. 11.8. Force Majeure. Neither Party will be responsible or liable for any failure or delay in its performance under this Agreement (except payment of Fees, which may be delayed but not excused) to the extent due to any cause beyond its reasonable control (“Force Majeure Event”). The Party suffering a Force Majeure Event shall use reasonable efforts to mitigate against the effects of such Force Majeure Event. For the avoidance of doubt, issues relating to COVID-19 will not be considered a Force Majeure Event. 11.9. Assignment. Each Party shall not assign this Agreement, in whole or part, or any right or interest herein, without the other Party’s prior written consent, not to be unreasonably withheld, and any purported assignment will be void. However, Procore may assign this Agreement without consent to an Affiliate, or in connection with a merger, consolidation, or corporate reorganization, sale of all or substantially all of its assets or business, or other change of control transaction. Subject to the foregoing, this Agreement will be binding upon and inure to the benefit of the Parties and their respective successors and permitted assigns. 11.10. Relationship of the Parties. The Parties are independent contractors. This Agreement does not create a partnership, franchise, joint venture, agency, fiduciary, or employment relationship between the Parties. 11.11. Entire Agreement; Order of Precedence. This Agreement (together with any SOWs and Orders) contains the entire understanding and agreement of the Parties concerning the subject matter hereof and supersedes all prior or contemporaneous communications, representations, agreements, and understandings, either oral or written, DocuSign Envelope ID: D4E4F8D4-84AE-4394-9B6D-BD966564D633DocuSign Envelope ID: 864A4536-2679-4503-9CBA-B8F08B8B945E Dec. 6, 2022 Item #5 Page 87 of 103 Procore_SSA_Rev 2022.01.10 Page 8 of 21 between the Parties with respect to its subject matter. This Agreement may only be amended or waived by a writing signed by both Parties; however, Procore may provide updated terms upon renewal, which will take effect when signed by both Parties. In the event of any conflict or inconsistency between or among the following documents, the order of precedence will be: (1) the DPA, (2) the Order, (3) SOW, (4) this Agreement, and (5) any links provided herein. Any amendment will take precedence over the document it amends. 11.12. Miscellaneous. If a provision of this Agreement is unenforceable or invalid, the provision will be revised so as to best accomplish the objectives of the Parties as evidenced by this Agreement, and the remainder of this Agreement will continue in full force. The English language version of this Agreement will be the version used when interpreting or construing this Agreement. Any notices in connection with this Agreement must be provided in English. Either Party’s failure to enforce any right under this Agreement will not waive that right. There are no third-party beneficiaries to this Agreement, and Customer acknowledges that Procore will have no obligations or liability whatsoever to any third parties with which Customer does business. 12. DEFINITIONS 12.1. “Affiliate” means an entity that controls, is controlled by, or is under common control of a Party, where “control” means ownership or control, directly or indirectly, of more than fifty percent (50%) of the voting interest of such entity or party (but only for so long as such control exists) or the right to otherwise control the decision making of the subject entity. 12.2. “Authorized Users” means any individual or agents authorized by Customer to access or use the Services. 12.3. “Customer Data” means any content, data, information, personal data (as described in Section 1.3), and other materials submitted by Customer or an Authorized User to the Services. Customer Data excludes Statistical Usage Data, any content from publicly available sources, and any suggestion, enhancement request, recommendation, correction, or other Feedback relating to the operation of the Subscription Services pursuant to Section 5.4. 12.4. “Documentation” means the official Procore-provided instructions, user guides, help and training manuals, descriptions of support, and other descriptive product information applicable to the Services, whether in electronic, paper, or equivalent form, as updated from time to time, accessible at https://support.procore.com/products/online/user-guide or other websites designated by Procore. 12.5. “Export Control and Sanctions Laws and Regulations” means all laws and regulations under applicable law controlling or regulating the export, re-export, or (in-country) transfer of goods, technology, software, or services, or those that impose other trade or financial sanctions against targeted countries, territories, individuals, or entities. 12.6. “Harmful Code” means code, files, scripts, agents, malware, or programs intended to do harm, including but not limited to viruses, worms, time bombs, and Trojan horses. 12.7. "Intellectual Property Rights” means all rights, title, and interest in all intellectual property, including patents, copyrights, trade secrets, mask works, trademarks, and other intellectual property rights of any sort throughout the world. 12.8. “Order” means a written or electronic order form, executed by the Parties, identifying the Services, scope, quantity, charges, and other information relevant to a specific transaction between Customer and Procore, herein incorporated by reference. 12.9. “Professional Services” means the implementation, technical, consulting, training, and similar services provided by or through Procore or its Affiliates, as described in the relevant Order or SOW. 12.10. “Reseller” means a third party authorized by Procore or its Affiliates to promote, distribute, and/or resell the Services. 12.11. “Services” means collectively, as applicable, the Subscription Services, Support Services, and Professional Services Customer has ordered, and Procore has agreed to provide, as indicated on the applicable Order or SOW. 12.12. “SOW” means a statement of work executed by the Parties describing Professional Services purchased by Customer pursuant to an Order, herein incorporated by reference. 12.13. “Statistical Usage Data” means usage information or data related to the access or use of the Services. Examples of Statistical Usage Data include information or data on user visits, user activity, and numbers and types of clicks or impressions, as well as statistical, functional, behavioral, or other information or data based on or derived from such access or use. 12.14. “Subscription Services” means the Procore software-as-a-service, and all associated Updates, offered on a subscription basis by Procore via an Order that provides the functionality described in the Documentation. DocuSign Envelope ID: D4E4F8D4-84AE-4394-9B6D-BD966564D633DocuSign Envelope ID: 864A4536-2679-4503-9CBA-B8F08B8B945E Dec. 6, 2022 Item #5 Page 88 of 103 Procore_SSA_Rev 2022.01.10 Page 9 of 21 12.15. “Subscription Term” means the entire period during which Customer is entitled to use the Subscription Services, including the initial term and any applicable renewal terms. 12.16. “Support Services” means the type of Procore’s customer support for the Subscription Services described in Exhibit A, and as may be specified or purchased within an Order. 12.17. “Updates” means all updates, enhancements, and other modifications that Procore makes generally available, at no additional charge, to its customers of the Subscription Services identified in an Order. 12.18. “Usage Metrics” means the metrics used to determine the scope of Customer’s access and use of the Subscription Services and associated Fees, as set out in an Order. // Signature Page Follows // DocuSign Envelope ID: D4E4F8D4-84AE-4394-9B6D-BD966564D633DocuSign Envelope ID: 864A4536-2679-4503-9CBA-B8F08B8B945E Dec. 6, 2022 Item #5 Page 89 of 103 DocuSign Envelope ID: 864A4536-2679-4503-9CBA-B8F08888945E PROCORE SUBSCRIPTION AND SERVICES AGREEMENT Procore By: 4bV4t;l (sign here) Signature Page By: RLSBAD, a municipal of the State of California Alice Bisgrove, VP, Assistant General Counsel (print name/title) Associate General counsel (sign here) Benjami n s inger (print name/title) CLO & corporate secretary APPROVED AS TO FORM: Cindie McMahon, City Attorney BY: (;LJ.ir., ~-~ City Attorney Procore_SSA_Rov 2022.01.10 ATTEST: ~FAVIOLA MEDINA City Clerk Services Manager Page 10 of 21 Dec. 6,2022 Item #5 Page 90 of 103 Procore_SSA_Rev 2022.01.10 Page 11 of 21 PROCORE SUBSCRIPTION AND SERVICES AGREEMENT Exhibit A – Support Services and SLA Agreement 1. OVERVIEW This Support Services and SLA Agreement (“SLA”) is entered into by Procore and Customer and covers the Procore Subscription Services defined in the Procore Subscription and Services Agreement (“Agreement”) to which this SLA is attached. Except as otherwise modified or defined herein, all capitalized terms in this SLA have the meanings set forth in the Agreement. 2. DEFINITIONS For purposes of this SLA, the following definitions apply: 2.1 “Scheduled Downtime” means the window during which scheduled maintenance of the Subscription Services is performed. Procore shall use commercially reasonable efforts to not provide more than 6 hours of Scheduled Downtime per calendar month. Scheduled maintenance is communicated to users through “in app” notifications, with a minimum target of a 24-hour notice. 2.2 “Service Credit” means a calculation dividing the number of days of Subscription Service credited by 365, then multiplied by the annual Subscription Fee. In the event the annual Subscription Fee was $100,000 and the customer was due 3 days of service credit, then 3 divided by 365 times $100,000 would result in a Service Credit to the customer for $821.92. 3. SERVICE AVAILABILITY Procore’s service-level objective for the Subscription Services is 99.9% of the time, 7 days a week, and 24 hours per day as calculated over a calendar month excluding Scheduled Downtime. This does not include Force Majeure Events or other factors outside of Procore’s reasonable control. 3.1 Service Availability. The Subscription Service will be available 99.9% of the time, 7 days a week, and 24 hours per day as calculated over a calendar month excluding Scheduled Downtime (“Service Availability”). If Procore does not meet the Service Availability in any individual calendar month, Customer may notify Procore support via a support ticket within 5 business days of a failure by Procore to achieve the Service Availability, including any other relevant details concerning the incident (“SLA Claim”). Procore will promptly investigate and make a good faith, reasonable determination, based on the information available, as to the validity of the SLA Claim. Failure to timely notify Procore will forfeit Customer’s right to receive a Service Credit. 3.2 Service Credits. Upon Procore’s validation of the SLA Claim, Procore will apply a Service Credit on Customer’s next invoice, calculated in accordance with the chart below. If the Subscription Service (or any portion thereof) is discontinued for any reason, the Service Credit will be in the form of a pro rata rebate at the end of the applicable subscription period. The aggregate maximum number of Service Credits to be issued to Customer for any and all SLA Claims that occur in a calendar month will not exceed fifteen (15) days of Service Credit. Uptime Availability Days of Service Credit < 99.9% - ≥ 99.0% 3 < 99.0% - ≥ 95.0% 7 < 95.0% 15 3.3 Exclusions. Customer will not have any remedies under this SLA to the extent any SLA Claim is due to: (a) Customer’s use of the Subscription Services outside the permitted scope described in the Agreement; (b) any period of unavailability lasting less than ten (10) minutes; (c) Force Majeure Events or other factors outside of Procore’s reasonable control; (d) malfunction of equipment, systems, software, network connections, or other infrastructure not owned or operated by Procore; or (e) Scheduled Downtime. 3.4 Exclusive Remedy. Except for gross negligence or willful misconduct by Procore, the remedies set forth herein represent Customer’s sole and exclusive remedy for breach of the SLA described herein. 4. SUPPORT DocuSign Envelope ID: D4E4F8D4-84AE-4394-9B6D-BD966564D633DocuSign Envelope ID: 864A4536-2679-4503-9CBA-B8F08B8B945E Dec. 6, 2022 Item #5 Page 91 of 103 Procore_SSA_Rev 2022.01.10 Page 12 of 21 4.1 Access to Support. Customer and Authorized Users have access to technical support via telephone, online chat, email, or self-paced online tutorials. Support hours can be found at support.procore.com/references/contact-support. Support does not include training sessions on the features and functionality of the Subscription Services (e.g., implementation) or training in relevant computer skills considered prerequisite to an individual’s ability to use personal computers, the Internet/World Wide Web, and online software in accordance with the requirements of the Agreement. Furthermore, only qualified, trained Customer support personnel or Authorized Users familiar with Subscription Services are authorized to contact Procore to obtain support. 4.2 Reporting. Before requesting support from Procore, Customer shall use reasonable efforts to comply with any applicable operating and troubleshooting procedures as set forth in the Documentation or as otherwise provided by Procore. If such efforts are unsuccessful, Customer should promptly notify Procore support via Procore’s Ticket Tracking System (“System”) of the issue including any supporting information Customer believes may assist Procore in both its diagnostic determination as well as the Severity/Priority classification. Upon Procore’s receipt of a support request via the System, Procore shall use commercially reasonable efforts to answer questions and provide standard error corrections to known problems. In the event of any problems or errors involving the Subscription Services that Procore cannot immediately resolve, Procore shall begin working on a resolution to the problem and shall work diligently and in a commercially reasonable manner on the problem until it is resolved. 4.3 Status Updates. Response time commitment for a first support contact between Procore and Customer after Customer contacts Procore for support is based on the Severity/Priority of the issue as entered into the System by the Customer. The Severity/Priority levels reported by Customer will be determined by Procore in its reasonable discretion, taking into consideration Customer’s report of the impact and functionality of the issue and impact to Customer. Once Procore receives an error ticket as reported from Customer, Procore shall provide Customer with timely status updates as reasonably determined by Procore until a workaround or other resolution is established by Procore. DocuSign Envelope ID: D4E4F8D4-84AE-4394-9B6D-BD966564D633DocuSign Envelope ID: 864A4536-2679-4503-9CBA-B8F08B8B945E Dec. 6, 2022 Item #5 Page 92 of 103 Procore_SSA_Rev 2022.01.10 Page 13 of 21 Procore Customer Data Processing Addendum This Data Processing Addendum (this "DPA") supplements and forms part of the Subscription Services Agreement or other agreement between Customer and Procore about the provision of Services by Procore to Customer ("Agreement") when Data Protection Law applies to Customer’s access and use of the Services to process Customer Personal Data (defined below). Customer enters into this DPA on behalf of itself and, to the extent required under applicable law, in the name of and on behalf of its Data Controller Affiliates (defined below) ("Customer"). For the purposes of this DPA only, and except as otherwise indicated, the term "Customer" shall include Customer and Data Controller Affiliates. Data Processing a. Scope and Roles. This DPA applies when Customer Personal Data is processed by Procore under applicable Data Protection Law. In this context, where the law provides for the roles of "controller" and "processor," Customer is the Controller of the Customer Personal Data covered by this DPA, and Procore shall be a Processor Processing Customer Personal Data on behalf of Customer and this DPA shall apply accordingly. b. Details of Data Processing. a. Subject matter. The subject matter of the data Processing under this DPA is Customer Personal Data. b. Duration. The duration of the Processing under this DPA is determined by the Agreement. Regardless of whether the Agreement has terminated or expired, this DPA will remain in effect until, and automatically expire when Procore deletes or anonymizes all Customer Personal Data as described in the Agreement. c. Purpose. The purpose of the processing under the DPA is the provision of the Services by Procore to Customer as specified in the Agreement. d. Nature of the Processing. Customer Personal data is processed by Procore in connection with the Services under the Agreement and/or any applicable Order. e. Categories of Data Subjects. The Data Subjects of Customer which may include Customers’ Authorized Users, employees, contractors, suppliers, or other third parties whose Personal Data is uploaded by Customer for use in connection with the Services. f. Categories of data. Identifiers (contact detail including name, email, phone number and addresses); Employment Data (professional data, contact details, hours worked, site access) IT Data (IP addresses, browser type, language preferences, cookies data);and other Personal Data that Customer or its Authorized Users elect to submit to the Services. g. Special categories of data (if appropriate). Procore and/or its Subprocessors do not intentionally collect or process any special categories of data in connection with the provision of the Services under the Agreements. However, Customer or its Affiliates may choose to include this type of data within content that the Customer instructs Procore to process on its behalf. c. Compliance with the laws. Each party will comply with all laws, rules and regulations applicable to it and binding on it in the performance of this DPA. d. Jurisdiction Specific Terms. Certain jurisdictions require other specific terms. Where required under applicable Data Protection Law, this DPA fully incorporates the applicable Jurisdiction Specific Terms available at http://procore.com/legal/jurisdiction-specific-terms and updated from time to time, and including the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq., and its implementing regulations: Procore’s obligations to Customer under the DPA are only those express obligations imposed by the CCPA that require that a "Business" and a "Service Provider" to have in place. Each party is responsible for fulfilling its respective obligations set out in the CCPA. Procore will not collect, sell, retain, disclose or use the Personal Information of the Consumer for any purpose other than to perform the Subscription Services specified in the Agreement, or as otherwise permitted by CCPA. Procore certifies that it understands and will comply with the restrictions set forth herein. The terms used in the applicable provisions of the DPA shall be replaced as follows: "Personal Data" shall mean "Personal Information"; "Controller" shall mean "Business"; "Processor" shall mean "Service Provider"; and "Data Subject" shall mean "Consumer" (collectively, the "replaced terms"). Further, the replaced terms shall have the definitions ascribed to in the CCPA. Documented Instructions. a. Customer Instructions. Customer shall, in its use of the Services, at all times provide documented instructions to Procore for the Processing of Customer Personal Data, in compliance with applicable Data Protection Law. The Parties agree that this DPA and the Agreement constitute Customer’s documented instructions regarding Procore’s Processing of Customer Personal Data ("Documented Instructions"). Procore will Process Customer Personal Data in accordance with Customer’s Documented Instructions. Additional instructions outside the scope of the Documented Instructions DocuSign Envelope ID: D4E4F8D4-84AE-4394-9B6D-BD966564D633DocuSign Envelope ID: 864A4536-2679-4503-9CBA-B8F08B8B945E Dec. 6, 2022 Item #5 Page 93 of 103 Procore_SSA_Rev 2022.01.10 Page 14 of 21 (if any) require prior written agreement between Procore and Customer, including agreement on any additional fees payable by Customer to Procore for carrying out such instructions. b. Obligations and Indemnity. Customer shall ensure that its Documented Instructions comply with all laws, rules and regulations applicable to the Customer Personal Data, and that the Processing of Customer Personal Data per Customer's Documented Instructions will not cause Procore to be in breach of applicable Data Protection Law. Customer is solely responsible for the accuracy, quality, and legality of (a) the Customer Personal Data provided to Procore by or on behalf of Customer; (b) how Customer acquired any such Customer Personal Data; and (c) the Documented Instructions it provides to Procore regarding the Processing of such Personal Data. Customer shall not provide or make available to Procore any Personal Data in violation of the Agreement, this DPA, or otherwise inappropriate for the nature of the Services and shall indemnify Procore from all claims and losses in connection therewith. Confidentiality of Customer Personal Data. Procore will not access or use, or disclose to any third party, any Customer Personal Data, except, in each case, as necessary to maintain or provide the Services, or as necessary to comply with the law, a Public Authority Request and/or a valid and binding order of a governmental body (such as a subpoena or court order). If a governmental body sends Procore a demand for Customer Personal Data, Procore will attempt to redirect the governmental body to request that data directly from Customer. As part of this effort, Procore may provide Customer’s basic contact information to the governmental body. If compelled to disclose Customer Personal Data to a governmental body, then Procore will give Customer reasonable notice of the demand to allow Customer to seek a protective order or other appropriate remedy unless Procore is legally prohibited from doing so. Authorized persons. Procore shall ensure that all persons authorized to Process Customer Personal Data on behalf of Procore are made aware of the confidential nature of the Customer Personal Data, and have committed themselves to confidentiality (e.g., by confidentiality agreements) or are under an appropriate statutory obligation of confidentiality. Authorized Subprocessors. Customer hereby generally authorizes Procore to engage Subprocessors in accordance with this Section 5. Customer approves the Subprocessors currently listed below as Appendix A. If Customer transfers Customer Personal Data to Procore under the SCCs, the above authorization will constitute Customer's prior written consent to the subcontracting by Procore of the Processing of Customer Personal Data if such consent is required under the SCCs. Procore may remove, replace or appoint suitable and reliable further Subprocessors, provided that Procore shall notify Customer, update the list of Subprocessors and provide Customer with an opportunity to object where required under applicable Data Protection Law. a. Objections. If the Customer reasonably objects to the engagement of a new Subprocessor, Procore shall have the right to cure the objection through one of the following options (to be selected at Procore’s sole discretion): (a) Procore cancels its plans to use the Subprocessor with regard to Customer Personal Data; (b) Procore will take the corrective steps requested by Customer in its objection (which removes Customer's objection) and proceed to use the Subprocessor with regard to Customer Personal Data; (c) Procore may cease to provide or Customer may agree not to use (temporarily or permanently) the particular aspect of the Service that would involve the use of such Subprocessor with regard to Customer Personal Data; and (d) Procore provides Customer with a written description of commercially reasonable alternative(s), if any, to such engagement, including without limitation modification to the Services. If Procore, in its sole discretion, cannot provide any such alternative(s), or if Customer does not agree to any such alternative(s) if provided, Procore and Customer may terminate this DPA with prior written notice, or suspend the affected Services. Termination shall not relieve Customer of any fees or charges owed to Procore for Services provided up to the effective date of the termination under the Agreement. In the event that Procore elects to suspend Customer’s access to and use of affected Services, such suspension shall relieve Customer of any fees or charges owed to Procore for such Services after the effective date of the suspension. If Customer does not object to a new Subprocessor's engagement within ten (10) days of notice by Procore, that new Subprocessor shall be deemed accepted. b. Subprocessor Obligations. Where Procore authorizes a Subprocessor as described in Section 5.1: a. Procore will restrict the Subprocessor’s access to Customer Personal Data only to what is necessary to provide or maintain the Services in accordance with the Documentation, and Procore will prohibit the Subprocessor from accessing Customer Personal Data for any other purpose; b. Procore will enter into a written agreement with the Subprocessor and, to the extent that the Subprocessor performs the same data processing services provided by Procore under this DPA, Procore will impose on the Subprocessor the same contractual obligations that Procore has under this DPA; and c. Procore will remain responsible for its compliance with the obligations of this DPA and for any acts or omissions of the Subprocessor that cause Procore to breach any of Procore obligations under this DPA. Security; Audits; Personal Data Breach; Impact Assessments. a. Security. Procore’s provision of the Services will be consistent with the measures described in Appendix B. DocuSign Envelope ID: D4E4F8D4-84AE-4394-9B6D-BD966564D633DocuSign Envelope ID: 864A4536-2679-4503-9CBA-B8F08B8B945E Dec. 6, 2022 Item #5 Page 94 of 103 Procore_SSA_Rev 2022.01.10 Page 15 of 21 a. Updates to Procore Security Controls. Customer is responsible for reviewing the information made available by Procore relating to data security and making an independent determination as to whether the Security Controls set forth in Section 6.1, above, meet Customer’s requirements and legal obligations under applicable law. Customer acknowledges that the Security Controls are subject to technical progress and development and that Procore may update or modify the Security Controls from time to time provided that such updates and modifications do not materially degrade the overall security of the Services during the Subscription Term b. Confidential Security Reports and Audits. Procore does and will maintain compliance with SSAE 18 (SOC 1 & 2), or appropriate and comparable equivalents of those audit standards, for the duration of its processing of Customer Personal Data. Upon request, Procore shall, no more than once per calendar year make available for Customer’s review, a summary copy of an audit report(s) ("Report") that reflects such compliance, a request may be made by emailing legalnotice@procore.com. Customer acknowledges and agrees that such Reports are Procore’s Confidential Information. Procore shall also provide a requesting Customer with a Report and/or confirmation of Procore's own audits and/or a report of third party auditors' audits of its Subprocessors that have been provided by those Subprocessors to Procore, to the extent such reports or evidence may be shared with Customer (“Third-party Subprocessor Audit Reports”). Customer acknowledges that (a) Reports and Third-party Subprocessor Audit Reports shall be considered Confidential Information as well as confidential information of the third-party Subprocessor and (b) certain third-party Subprocessors to Procore may require Customer to execute a non-disclosure agreement with them in order to view a Third-party Subprocessor Audit Report. c. Personal Data Breach. In the event of a Personal Data Breach, Procore shall notify Customer without undue delay and otherwise respond as described in 6.3.1 below. In addition, Procore shall, taking into account the nature of the Processing and the information available to Procore assist Customer in ensuring compliance with its obligations under applicable Data Protection Law to conduct a data protection impact assessment and, with prior notice, to assist with consultations with the Competent Supervisory Authority (defined below), where required. a. Practices. Procore does and will (a) maintain and follow a documented incident response plan and associated procedures consistent with industry standards for Personal Data Breach handling; (b) investigate Personal Data Breach of which Procore becomes aware, and, within the scope of the Services, and take such steps as Procore in its sole discretion deems necessary and reasonable to remediate such Personal Data Breach; and (c) notify Customer without undue delay upon confirmation of a Personal Data Breach that is known or reasonably suspected by Procore to affect Customer Personal Data, and provide Customer with reasonably requested information about such Personal Data Breach and the status of the remediation and restoration activities. The obligations herein shall not apply to a Personal Data Breach caused by Customer, Customer’s Authorized Users or misuse of Customer’s Access Credentials. Procore’s obligation to report or respond to a Personal Data Breach under this Section 6 is not and will not be construed as an acknowledgement by Procore of any fault or liability of Procore with respect to the Personal Data Breach. Procore Assistance with Data Subject Requests. Procore will inform Customer of requests from Data Subjects exercising their Data Subject rights under applicable Data Protection Law (e.g., including but not limited to rectification, deletion and blocking of data) addressed directly to Procore regarding Customer Personal Data. Customer shall be responsible for handling such requests of Data Subjects. Upon a written request for assistance by Customer, Procore will reasonably assist Customer with handling such Data Subject request. Procore may charge Customer no more than a reasonable charge to perform such assistance, and such charges will be set forth in a quote and agreed in writing by the Parties, or as set forth in the Agreement. If Customer does not agree to the quote, the Parties agree to reasonably cooperate to find a feasible solution. International Transfers of Personal Data a. U.S. Based Processing. Notification of Changes. Customer acknowledges and agrees that Procore may transfer and process Customer Personal Data to and in the United States and anywhere else in the world where Procore, its Affiliates, or its Subprocessors maintain data processing operations. Procore shall ensure that such transfers are made in compliance with applicable Data Protection Law and this DPA. b. Application of SCCs. The applicable SCC Controller-to-Processor Clauses, currently available through Procore’s Jurisdiction Specific Terms located at http://procore.com/legal/jurisdiction-specific-terms, will apply to Customer Personal Data that is transferred via the Services from Europe (defined below) and/or the United Kingdom, either directly or via onward transfer, to any country not recognized by the European Commission, the Swiss Federal Data Protection and Information Commissioner and/or a competent United Kingdom regulatory authority or governmental body as providing an adequate level of protection for Customer Personal Data. This DPA fully incorporates the applicable SCCs by reference. If Customer submits Customer Personal Data to the Services for Processing by Procore, Customer and Procore will be deemed to have entered into the SCCs, where applicable, and the submission of such Customer Personal Data to the Services will constitute Customer’s prior written consent to the transfer and Processing by Procore if such consent is required under the SCCs. The SCCs, will not apply where the Customer Personal Data is DocuSign Envelope ID: D4E4F8D4-84AE-4394-9B6D-BD966564D633DocuSign Envelope ID: 864A4536-2679-4503-9CBA-B8F08B8B945E Dec. 6, 2022 Item #5 Page 95 of 103 Procore_SSA_Rev 2022.01.10 Page 16 of 21 transferred in accordance with an Alternative Transfer Mechanism (defined below), such as when necessary for the performance of Services pursuant to the Agreement or on Customer’s Documented Instructions. c. Explicit Consent and Notice. Customer shall bear sole responsibility for obtaining its Authorized User’s and/or Data Subjects’ informed and explicit consent prior to the transfer of any Customer Personal Data to Procore in a manner consistent with the applicable Data Protection Law. If, at any time, an Authorized User and/or Data Subject withdraws any consent given pursuant to this Subsection, Customer shall immediately inform Procore in writing at privacy@procore.com and cease use and collection of Customer Personal Data related to such objecting Authorized User and/or Data Subject. Customer shall keep an electronic record of all consents given, and any consents withdrawn, by Authorized Users and/or Data Subjects and shall make such records available to Procore upon request. Return or Deletion of Customer Data. a. Upon termination or expiration of the Agreement, Procore shall (at Customer's written request) anonymize all Customer Personal Data in its possession or control. This requirement shall not apply to the extent Procore is required by applicable law to retain some or all of the Customer Personal Data. b. Customer acknowledges that the Services are used as a system of record and that data uploaded to the Services is required to be retained under applicable laws for the establishment, exercise or defense of legal claims. As an equivalent to deletion, Procore shall permanently and securely anonymize Customer Personal Data to the extent no individual could be identified. Indemnification by Customer. To the maximum extent permitted by applicable law and in addition to any other remedy that is available, including the indemnities provided in the Agreement, Customer agrees to defend, indemnify and hold harmless Procore, its Affiliates and Procore’s Subprocessors, including their respective officers, directors, employees, agents, successors, representatives, agents, resellers and assigns (each, a "Procore Indemnitee") from and against any and all Losses resulting Customer’s violation of this DPA and/or the infringement or violation by Customer, its Authorized Users or any other user of Customer’s Access Credentials, of any privacy or other right of any person under applicable Data Protection Law. Limitation of Liability a. Exclusion of Damages. UNDER NO CIRCUMSTANCES AND REGARDLESS OF THE NATURE OF ANY ACTION SHALL THE PROCORE INDEMNITEES BE LIABLE, DIRECTLY OR INDIRECTLY, IN WHOLE OR IN PART, TO CUSTOMER OR TO ANY OTHER PERSON OR ENTITY FOR ANY LOSSES OR LOSS, DAMAGE, CORRUPTION OR RECOVERY OF CUSTOMER PERSONAL DATA ARISING FROM OR RELATING TO CUSTOMER’S BREACH OF ITS OBLIGATIONS IN THIS DPA. b. Limitation of Liability. Each Party’s and all of its Affiliates’ liability, taken together in the aggregate, arising out of or related to this DPA, and all DPAs between Customer and its Data Controller Affiliates and Procore, whether in contract, tort or under any other theory of liability, is subject to the "Limitation of Liability" section of the Agreement and the applicable cap (maximum) for the relevant party set forth in the Agreement. Any reference in such section to the liability of a party means the aggregate liability of that party and all of its Affiliates under the Agreement and all DPAs together. For the avoidance of doubt, the Procore Indemnitees’ total liability for all Actions by Customer and all of Customers Affiliates (including Data Controller Affiliates) arising out of or related to the Agreement and all DPAs shall apply in the aggregate for all claims under both the Agreement and all DPAs established under the Agreement, and, in particular, shall not be understood to apply individually and severally to Customer and/or to any Customer Affiliate that is a contractual party to any such DPA. To the extent required by applicable law, (a) this section is not intended to modify or limit the Parties’ liability for Data Subject claims made against a Party where there is joint and several liability under Data Protection Law, or (b) limit either Party’s responsibility to pay penalties imposed on such Party by a regulatory authority. Termination of the DPA. This DPA will continue in force until the termination of the Agreement (the "Termination Date"), provided that the data protection obligations of this DPA and the SCCs shall continue to apply for so long as Procore processes Customer Personal Data. Severance. Should any provision of this DPA be invalid or unenforceable, then the remainder of this DPA shall remain valid and in force. The invalid or unenforceable provision shall be either (a) amended as necessary to ensure its validity and enforceability, while preserving the parties’ intentions as closely as possible or, if this is not possible, (b) construed in a manner as if the invalid or unenforceable part had never been contained therein. Entire Agreement; Order of Precedence. Except as supplemented by this DPA, the Agreement will remain in full force and effect. Any conflict between the terms of the Agreement and this DPA related to the processing of Customer Personal Data are resolved in the following order of priority: (1) the Standard Contractual Clauses, where applicable; (2) the DPA; and (3) the Agreement. Definitions. Unless otherwise defined in the Agreement, all capitalized terms used in this DPA will have the meanings given to them below: DocuSign Envelope ID: D4E4F8D4-84AE-4394-9B6D-BD966564D633DocuSign Envelope ID: 864A4536-2679-4503-9CBA-B8F08B8B945E Dec. 6, 2022 Item #5 Page 96 of 103 Procore_SSA_Rev 2022.01.10 Page 17 of 21 a. "Access Credentials" means any user name, identification number, password, license or security key, security token, PIN, or other security code, method, technology, or device used, alone or in combination, to verify an individual's identity and auuthorization to access and use the Services. b. "Action" means any claim, action, cause of action, demand, lawsuit, arbitration, inquiry, audit, notice of violation, proceeding, litigation, citation, summons, subpoena, or investigation of any nature, civil, criminal, administrative, regulatory, or other, whether at law, in equity, or otherwise. c. "Affiliates", "Customer Data", "Procore", and "Services" shall each have the meaning ascribed to it in the Agreement. d. "Alternative Transfer Mechanism" means a mechanism, other than SCCs that enables the lawful transfer of Personal Data from Europe or the U.K. to a third country in accordance with applicable Data Protection Law. e. "Competent Supervisory Authority" means, in accordance with Clause 13 of the EU SCCs, (i) the supervisory authority applicable to the data exporter in its EEA country of establishment or, (ii) where the data exporter is not established in the EEA, the supervisory authority applicable in the EEA country where the data exporter's EU representative has been appointed pursuant to Article 27(1) of the GDPR, or (iii) where the data exporter is not obliged to appoint a representative, the supervisory authority applicable to the EEA country where the data subjects relevant to the transfer are located. With respect to Personal Data to which the UK GDPR applies, the competent supervisory authority is the Information Commissioners Office (the "ICO"). With respect to Personal Data to which the Swiss DPA applies, the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner. f. "Controller" means the entity that determines as a legal person alone or jointly with others the purposes and means of the Processing of Personal Data. Unless otherwise specified, Controller or "data exporter" refers to Customer. g. "Customer", as used on this DPA, shall include Customer (as defined in the Agreement) and its Data Controller Affiliates. h. "Customer Personal Data" means Customer Data submitted to Procore for Processing in connection with the Services pursuant to the Agreement, which contains Personal Data. i. "Data Controller Affiliates" means any of Customer's Affiliates that have not signed or otherwise accepted their own Order with Procore and therefore would not be a "customer" as defined under the Agreement but is an entity which is: (i) subject to Data Protection Law; and (ii) permitted to use the Procore Services pursuant to the Agreement between Customer and Procore. For the avoidance of doubt, no third-party beneficiaries are intended. j. "Data Protection Law" means any data protection and privacy laws and regulations that are applicable to the processing of Customer Personal Data by Procore, including, where applicable, the laws listed in Procore’s Jurisdiction Specific Terms available at http://procore.com/legal/jurisdiction-specific-terms, as may be amended, superseded or replaced from time to time. k. "Data Subject" means the identified or identifiable person to whom Customer Personal Data relates. l. "Documented Instructions" has the meaning ascribed in Subsection 2.1 of this DPA. m. "Europe" means the European Economic Area and Switzerland. n. "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data and repealing of Directive 95/46/EC (General Data Protection Regulation) o. "including" and its derivatives mean "including but not limited to." p. "Losses" means any and all losses, damages, deficiencies, claims, actions, judgments, settlements, interest, awards, penalties, fines, costs, or expenses of whatever kind, including reasonable attorneys’ fees, expert witness fees, settlement amounts, and the costs of enforcing any right to indemnification hereunder and the cost of pursuing any insurance providers. q. "Personal Data" means any data that relates to an identified or identifiable natural person, to the extent that such information is protected under applicable Data Protection Law. r. "Personal Data Breach" means a breach of security which results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data Processed by Procore or Procore’s Subprocessors. s. "Procore Indemnitee" shall have the meaning ascribed to it in Section 11, above. t. "Processing" (unless defined differently under applicable Data Protection Law) means any operation or set of operations which is performed upon Personal Data, manually or automatically, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction. u. "Processor" means an entity which Processes Personal Data on behalf of the Controller pursuant to the Agreement. Processor or "data importer" in this DPA refers to Procore. v. "Public Authority Request" means a government agency or law enforcement authority, including a judicial authority request for information. w. "Services" means Procore’s Services as set forth in the Agreement. x. "Standard Contractual Clauses" or "SCCs" means : (i) where the GDPR applies the contractual clauses annexed to the European Commission's Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the DocuSign Envelope ID: D4E4F8D4-84AE-4394-9B6D-BD966564D633DocuSign Envelope ID: 864A4536-2679-4503-9CBA-B8F08B8B945E Dec. 6, 2022 Item #5 Page 97 of 103 Procore_SSA_Rev 2022.01.10 Page 18 of 21 transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (the "EU SCCs"); (ii) where the UK GDPR applies, the applicable standard data protection clauses adopted pursuant to Article 46(2)(c) or (d) of the UK GDPR (the "UK SCCs"); and (iii) where the Swiss DPA applies, the applicable standard data protection clauses issued, approved or otherwise recognized by the Swiss Federal Data Protection and Information Commissioner ("FDPIC")(the "Swiss SCCs"). y. "Subprocessor" means any Processor engaged by Procore to assist in processing Customer Personal Data in connection with the Services per Customer’s Documented Instructions under the terms of the Agreement and this DPA. Subprocessors may include Procore’s Affiliates, but shall exclude Procore employees, contractors, and consultants. z. "UK GDPR" means the UK General Data Protection Regulation, as retained in UK law by the European Union (Withdrawal) Act 2018 and renamed by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2020 and the UK's Data Protection Act 2018. Appendix A – List of Procore Subprocessors Subprocessor Name Nature/Description of Processing Subject of Processing/Customer Personal Data Country of Storage/Processing Amazon Web Services Infrastructure Cloud Hosting i.e.: Authorized User Identifiers, Employment Data, IT Data United States S3 Buckets for storage are based on region of Customer and include the following regions as applicable: United States (default) Australia & New Zealand Brazil Canada France Germany Hong Kong Ireland Italy Korea Singapore South Africa Sweden United Arab Emirates (UAE) United Kingdom Amplitude Inc Product Analytics i.e.: Authorized User Identifiers, Employment Data, IT Data United States Ecrion Software PDF Template Processing i.e.: Authorized User Identifiers United States Fullstory Digital experience intelligence (DXI) platform i.e.: Authorized User Identifiers and video content upon consent. United States Google Analytics Product Analytics i.e.: Authorized User Identifiers, Employment Data, IT Data Global LaunchDarkly Procore Feature Management i.e.: Authorized User Identifiers, Employment Data, IT Data United States DocuSign Envelope ID: D4E4F8D4-84AE-4394-9B6D-BD966564D633DocuSign Envelope ID: 864A4536-2679-4503-9CBA-B8F08B8B945E Dec. 6, 2022 Item #5 Page 98 of 103 Procore_SSA_Rev 2022.01.10 Page 19 of 21 Looker Data Analytics i.e.: Authorized User Identifiers such as email or user ID, IT Data for requests management United States New Relic Application, Database, and Machine monitoring i.e.: Authorized User Email Identifiers United States Pendo Usage Data Collection Communication i.e.: Authorized User Identifiers, Employment Data, IT Data United States SalesForce Customer Account Management Customer Identifiers and Account Information United States Sendgrid Transactional and Marketing Email i.e.: Authorized Users Email Identifiers United States Snowflake Data Warehouse i.e.: Authorized User Identifiers, IT Data, Employment Data United States Sumo Logic Application and System log aggregation i.e.: Authorized User Identifiers United States Tableau Data Visualization Reporting, SQL i.e.: Authorized User Identifiers, IT Data, Employment Data United States BugSnag Error Message Logging i.e.: Authorized User IT Data and Identifiers based on error United States Additional Subprocessors for Procore Estimating Services ("Estimating") Application Name Nature/Description of Processing Subject of Processing/Customer Personal Data Country of Storage/Processing Microsoft Azure Infrastructure / Cloud Hosting i.e.: Authorized User Identifiers, Employment Data, IT Data United States Stripe Payment processor i.e.: Authorized User Identifiers, IT Data, credit card processing as processed by Stripe United States Baremetrics Reporting for stripe i.e.: Authorized User Identifiers, IT Data, proof of payment United States Hubspot CRM i.e.: Authorized User Identifiers, Employment Data, IT Data United States Fullstory Application playback for support i.e.: Authorized User Identifiers, IT Data and Screen capture United States DocuSign Envelope ID: D4E4F8D4-84AE-4394-9B6D-BD966564D633DocuSign Envelope ID: 864A4536-2679-4503-9CBA-B8F08B8B945E Dec. 6, 2022 Item #5 Page 99 of 103 Procore_SSA_Rev 2022.01.10 Page 20 of 21 Appendix B - Technical and Organizational Security Measures At all times while Procore Processes Customer Personal Data, Procore will: (a) maintain and follow a written information security program (including the adoption and enforcement of internal policies and procedures) designed to (a) help Customer secure Customer Personal Data against accidental or unlawful loss, access or disclosure, (b) identify reasonably foreseeable and internal risks to Customer Personal Data and unauthorized access to the Services, and (c) minimize Customer Personal Data risks, including through risk assessment and regular testing. Procore will designate one or more employees to coordinate and be accountable for the information security program. The information security program will include the following Security Measures (as updated from time to time): Physical Access Controls: Procore takes measures, such as security personnel and secured buildings, designed to (i) prevent unauthorized persons from gaining access to Customer Data, (ii) manage, monitor and log movement of persons into and out of Procore facilities, and (iii) guard against environmental hazards such as heat, fire, and water damage. System Access Controls: Procore takes measures designed to prevent unauthorized use of Customer Data. These controls may vary based on the nature of the Processing undertaken and may include, among other controls, authentication via passwords and two-factor authentication, documented authorization processes, documented change management processes, logging of access on several levels, system audit or event logging, and related monitoring procedures to proactively record user access and system activity for routine review. Data Access Controls: Procore takes measures designed to ensure that Customer Data is accessible and manageable only by properly authorized staff, direct database query access is restricted, and application access rights are established and enforced to ensure that persons entitled to use a data processing system only have access to the Personal Data to which they have privilege of access, and that Customer Data cannot be read, copied, modified, or removed without authorization in the course of Processing. Access Policy: In addition to the access control rules set forth in Subsections 1.1–1.3 above, Procore implements an access policy under which access to its system environment, to Personal Data, and to other Customer Data is restricted to authorized personnel only. Input Controls: Procore takes measures to ensure that: (i) the Customer Data source is under the control of Customer; and (ii) Personal Data integrated into Procore’s systems is managed by secured file transfer from Customer and the Authorized User subject. Data Backup: Procore ensures that backups are made on a regular basis, are secured, and are encrypted when storing data to protect against accidental destruction or loss when hosted by Procore. Organizational Management: Procore maintains a dedicated staff responsible for the development, implementation, and maintenance of Procore’s data privacy and information security programs. Audit: Procore maintains audit and risk assessment procedures for the purposes of periodic review and assessment of risks to the organization, monitoring and maintaining compliance, and reporting the condition of its information security and compliance to senior internal management. Policies: Procore maintains data protection and information security policies and makes sure that policies and measures are regularly reviewed and where necessary, improve them. Integration: Procore communicates with Customer applications utilizing cryptographic protocols such as TLS 1.2 or above to protect information in transit over public networks. At the network edge, stateful firewalls, web application firewalls, and DDoS protection are used to filter attacks. Within the internal network, applications follow a multi- tiered model which provides the ability to apply security controls between each layer. Operations: Procore maintains operational procedures and controls to provide for configuration, monitoring, and maintenance of technology and information systems according to prescribed internal and adopted industry standards, including secure disposal of systems and media to render all information or data contained therein as undecipherable or unrecoverable prior to final disposal. or release from Controller possession. Incident Response: Procore maintains incident procedures designed to investigate, respond to, mitigate and notify of events related to Customer’s data. or information assets. A dedicated network operations and security operations staff performs rapid monitoring and response capabilities to address alerts. Network Security: Procore engages in network security controls such as providing for the use of enterprise firewalls and layered DMZ architectures, and intrusion detection systems and other traffic and event correlation procedures designed to protect systems from intrusion and limit the scope of any successful attack. DocuSign Envelope ID: D4E4F8D4-84AE-4394-9B6D-BD966564D633DocuSign Envelope ID: 864A4536-2679-4503-9CBA-B8F08B8B945E Dec. 6, 2022 Item #5 Page 100 of 103 Procore_SSA_Rev 2022.01.10 Page 21 of 21 Risk Management: Procore utilizes vulnerability assessment, patch management, and threat protection technologies and scheduled monitoring procedures designed to identify, assess, mitigate and protect against identified security threats, viruses and other malicious code. Business Continuity: Procore maintains business resiliency/continuity and disaster recovery procedures, as appropriate, designed to maintain service and/or recovery from foreseeable emergency situations or disasters. Testing is performed to evaluate the plans and recovery capabilities. Additional information: For additional information on Procore’s security measures and compliance please refer to the information made available and updated periodically at the following link: https://www.procore.com/trust-and-security/security. DocuSign Envelope ID: D4E4F8D4-84AE-4394-9B6D-BD966564D633DocuSign Envelope ID: 864A4536-2679-4503-9CBA-B8F08B8B945E Dec. 6, 2022 Item #5 Page 101 of 103 Exhibit 3 Intmatitn Tchntltgy Datmnt 1635 Faraday Ave ï Carlsbad, CA 92008 ï 760-602-2450 t Memorandum October 26, 2022 Tt: Roxanne Muhlmeister, Assistant Finance Director/Purchasing Officer Ftm: Doug Kappel, IT Applications Manager Via: Maria Callander, IT Director R: Approve the cooperative use of the California Multiple Award Schedules (CMAS) agreement with EC America, Inc The IT Department would like to cooperatively use the California Multiple Award Schedules (CMAS) agreement CMAS No. 3-118-70-1448C contract with EC America, Inc to provide for the implementation, licensing and subscription service of the Procore Project Management Pro solution. This solution provides for standardization of how construction projects are managed across the organization and implements tools that allow for visibility and transparency into project status and progression. Staff engaged an outside consultant that worked with city departments to identify and document the city’s project management needs and requirements. At the end of this engagement, the consultant’s recommendation was to implement Procore Project Management Pro for managing construction projects. EC America provides for the procurement of professional services, licenses and subscription services for the Procore Project Management Pro solution. As per Carlsbad Municipal Code Section 3.28.100 – Cooperative purchasing, “The purchasing officer shall have the authority to join with other public or quasi-public agencies in cooperative purchasing plans or programs for the purchase of goods and/or services by contract, arrangement or agreement as allowed by law and as determined by the purchasing officer to be in the city’s best interest. The purchasing officer may buy directly from a vendor at a price established by another public agency when the other agency has made their purchase in a competitive manner.” Approval for Exemption _______________________ ______________ Roxanne Muhlmeister, Date Assistant Finance Director/Purchasing Officer 11/14/2022 Dec. 6, 2022 Item #5 Page 102 of 103 (City of Carlsbad Muhlmeister October 26, 2022 Page 2 CC: Maria Callander, IT Department Director Cindie McMahon, City Attorney Brent Gerber, Senior Management Analyst Shea Sainz, Senior Contract Administrator Joy Lile, Contract Administrator Dec. 6, 2022 Item #5 Page 103 of 103