RFP SCC-26-018-BFI: Short-Term Lending Database

Exhibit A: Services Agreement

< Insert Offeror Name >

1 DEFINITIONS

Supplier is responsible for managing and successfully performing, completing, and delivering the Services in conformity with the Agreement. Supplier shall deliver the Solution, including all Documentation, Application(s), and Components, and the Services in the timeframes and Milestones set forth in the Agreement.

2.2.2 Supplier promptly will notify SCC upon becoming aware of any circumstances that may reasonably be expected to jeopardize the timely and successful completion (or delivery) of any Services. Supplier promptly will inform SCC of the steps Supplier is taking or will take to regain the schedule of activities to ensure timely completion of the Services.

2.2.3 Supplier agrees that failure to meet any one or more of the Milestones or to deliver the Services in accordance with the Agreement shall constitute a material breach resulting in damages to SCC. Unless otherwise excused by a provision of this Agreement, if Supplier is late in satisfying any Milestone or Deliverable by more than thirty (30) days, SCC may terminate the Agreement for material breach, collect damages, and/or pursue any other remedy available under the Agreement or at law or equity, except that SCC shall not assess nor shall it be entitled to collect damages for a day or days of delay solely caused by SCC.

2.3 Manner of Performance.

Supplier will perform the Services in compliance with the Agreement. For matters not covered by Service Level Agreements, Supplier shall perform the Services at levels of accuracy, quality, completeness, timeliness, responsiveness, and resource efficiency that are equal to or higher than the accepted industry standards of leading suppliers of similar services. Supplier shall ensure that the Services, Deliverables, Solution, and Application meet or exceed the Requirements.

2.4 Supplier Personnel.

2.4.1 Supplier shall ensure that all Supplier Personnel are competent and knowledgeable of the Agreement. Supplier shall be solely responsible for the supervision and conduct of Supplier Personnel, including all acts, omissions, gross negligence, and willful misconduct of Supplier Personnel.

2.4.2 SCC at all times maintains the right to require the immediate removal from the Services of any Supplier Personnel whose performance, conduct, or behavior is unacceptable or unprofessional or results in a security or safety breach.

2.5 Quality Assurance.

Supplier represents it has the resources, skill, experience, and qualifications to perform Quality Assurance activities for the Services. Supplier will perform commercially reasonable Quality Assurance processes to ensure that Services are performed in conformance with the Agreement, on a timely basis, and with the required high degree of professional quality and reliability.

2.6 Term and Renewals. The Agreement is effective and legally binding as of the Effective Date and shall continue for an initial period of two (2) years (the “Initial Term”) subject to the Agreement being terminated earlier or extended as provided for by the Agreement. SCC, in its sole discretion, may renew the Agreement for up to three (3) additional two (2) year renewal periods (each a “Renewal Term”) following the expiration of the Initial Term on the terms, conditions, and pricing then in effect. SCC may exercise its intention to exercise a Renewal Term by providing written notice to Supplier no later than thirty (30) days prior to expiration of the then-current term.

3 DATABASE INQUIRY FEES

3.1.2 Database Inquiry Fees collected by Supplier from Licensees are based on the fee schedule established by Commission order. The Commission may use the proposed fee provided by the Supplier in Exhibit F: Proposed Fee & Cost Analysis to inform its approved fee schedule.

3.1.3 Supplier will not be compensated, reimbursed, or paid any other fees, costs, travel, incidentals, or other type of expense unless agreed upon via Change Order executed by both parties.

a. Pay the subcontractor, supplier, or vendor for the proportionate share of the total payment received from Licensee attributable to the work or services performed or the Materials furnished by the subcontractor, supplier, or vendor under the Agreement; or

b. Notify SCC and the subcontractor, supplier, or vendor, in writing, of Supplier’s intention to withhold all or a part of the payment with the reason for nonpayment.

3.2.2 Supplier shall pay interest to its subcontractor, supplier, or vendor on all amounts owed by Supplier that remain unpaid after seven (7) days following receipt by Supplier of payment from SCC for work performed or Materials furnished by the subcontractor, supplier, or vendor except for amounts withheld as allowed under subsection 3.2.1(b) above. Unless otherwise provided under the terms of the Agreement, interest shall accrue at the rate of one percent per month.

3.2.3 Supplier shall include in each subcontract or purchase order a provision requiring the subcontractor, supplier, or vendor to include in each of its subcontracts or purchase orders a provision requiring each of its subcontractors, suppliers, and vendors to include or otherwise be subject to the same payment and interest requirements with respect to each lower-tier subcontractor, supplier, and vendor. Each subcontractor shall include with its invoice to, or request for payment from, Supplier a certification that that subcontractor has paid each of its suppliers and lower-tier subcontractors their proportionate share of previous payments received from Supplier attributable to the work performed or the Materials furnished by it under the Agreement.

5 INFORMATION TECHNOLOGY AND COMMUNICATION SERVICES

5.1 Data Privacy. In accordance with Code of Virginia § 2.2-2009(A)(5), during the performance of this Agreement, Supplier shall comply with all applicable federal and state laws and regulations pertaining to information security and privacy.

5.2 ITAA Compliance. All information and communications technology (“ICT”) provided by Supplier as part of the Agreement shall comply with the Information Technology Access Act, Code of Virginia §§ 2.2-3500 et seq. ICT includes any website, application, or other product or service intended to fulfill or enable the function of information processing and communication by electronic means, including transmission and display via the internet. Supplier must certify that ICT provided to SCC under the Agreement conforms with accessibility requirements as defined in Virginia Code § 2.2-3501. If Supplier cannot certify full conformance of the accessibility of the ICT, Supplier must provide:

a. Supplier-paid and completed Accessibility Conformance Report (as defined in Virginia Code § 2.2-3501) indicating the level of conformance with accessibility of the ICT being procured; and

b. Supplier-paid and completed Vendor Accessibility Roadmap (as that term is defined in Virginia Code § 2.2-3501) documenting any areas of nonconformance and including a timeline for each nonconforming area's completion, within a commercially reasonable timeframe.

Notwithstanding Supplier’s obligations, and consistent with 28 C.F.R. § 35.201 and 36 C.F.R. Part 1194, Appendix A, § E202, SCC may, in its sole discretion, procure ICT that does not conform with accessibility requirements if such procurement does not result in individuals with disabilities being denied the benefit of any SCC program, service, or activity.

5.3 Prohibited Technology. Pursuant to Code of Virginia § 2.2-5514, Supplier is prohibited from providing, whether directly or indirectly through subcontractors, any hardware, software, or services that have been prohibited for use on federal government systems by the U.S. Department of Homeland Security or which are prohibited pursuant to 2 C.F.R § 200.216. Supplier is prohibited on any government-issued device or government-owned or government-leased equipment, including mobile phones, desktop computers, laptop computers, tablets, or other devices capable of connecting to the Internet, or while connected to any wired or wireless Internet network owned, operated, or maintained by SCC or the Commonwealth of Virginia from downloading or using any application or accessing access any website: (a) developed by ByteDance Ltd. Or Tencent Holdings Ltd., including TikTok or WeChat; or (b) developed by DeepSeek (see Executive Order 46 (2025)).

5.4 Warranty. Supplier warrants that it is the owner of the software or technology being provided as part of the Services or that it otherwise has the right to use it and to grant SCC the right or license to use the technology without infringing or violating any law, rule, regulation, copyright, patent, trade secret, or other proprietary rights of a Third Party.

5.5 Artificial Intelligence Disclosure and Consent Requirement. Supplier shall not use any artificial intelligence as part of or in connection with the Services without prior disclosure to SCC and receipt of SCC’s prior written consent. Supplier promptly shall disclose any aspect of the Services utilizing or relying upon artificial intelligence. No usage of artificial intelligence will be authorized without Supplier’s full demonstration and warranty that the usage has appropriate safeguards and complies with SCC then-current policy on artificial intelligence and all applicable state and federal laws. Supplier shall not use SCC data for any artificial intelligence queries, training, or program creation. Supplier shall not use SCC data to develop machine learning models or to train artificial intelligence programs or databases or related technology. Any artificial intelligence incorporated into the Services must be capable of being enabled or disabled upon SCC request.

6.2 Measuring and Reporting Service Levels. Supplier will implement and utilize all measurement and monitoring tools and procedures required to measure and report Supplier’s performance against the Service Levels. Such tools shall permit reporting at a level of detail sufficient to verify compliance with the Service Levels and will be subject to review and verification by SCC. Supplier will provide SCC with information and access to such tools and procedures upon request for purposes of verification. In addition, Supplier will make available to SCC any data in Supplier’s possession regarding measurements taken by Supplier with respect to any Service Levels.

6.3 Determining Incident and Event Severity. Supplier will respond to and resolve Incidents and Events associated with the Services. Each Incident or Event will be assigned a Severity Level in accordance with the agreed upon Severity Level definitions. Supplier will make an initial assignment of Severity Level for Incidents and Events as they arise; however, each Severity Level designation is subject to SCC review and approval. Any change in an Incident or Event will require re-evaluation of the Severity Level.

7. IMPLEMENTATION AND DELIVERABLES

7.1 Implementation Generally. Supplier will perform the Services necessary to complete the Implementation in accordance with the Agreement, including Exhibit B (Solution Requirements) and Exhibit C (Solution Description) (collectively, the “Implementation Services”). The Implementation Services will be conducted in accordance with the Requirements and the Implementation Plan.

7.2.2 The Implementation Plan shall including, at a minimum: (a) a description of the technology methods and procedures, personnel, and organization that Supplier will use to perform such Implementation; (b) a schedule of Implementation activities; (c) a detailed description of the respective roles and responsibilities of SCC, Supplier, and other parties; (d) identification of the specific resources to be provided by SCC to support the Implementation; (e) the completion date for each Implementation activity; (f) the Acceptance Criteria (and, if appropriate, testing) to be applied by SCC in evaluating Implementation Deliverables and Milestones; (g) such other information and planning as are necessary to ensure that the Implementation takes place on schedule in a manner to timely meet and provide all Milestones and Deliverables.

7.2.3 Supplier will be responsible for preparing, revising, and finalizing the Implementation Plan, provided that: (a) Supplier will cooperate and work closely with SCC in finalizing the Implementation Plan (including incorporating SCC changes, modifications, and enhancements to the Implementation Plan and addressing SCC comments); and (b) the Implementation Plan (and any changes thereto, including any Implementation activities agreed upon after the Implementation start date) will be subject to written approval by SCC.

7.2.4 SCC responsibilities with respect to the Implementation Plan and Milestones shall be only those expressly set forth in the Implementation Plan and accepted by SCC.

7.2.5 SCC maintains the right to monitor, test, observe, and participate in the Implementation Services. Supplier will notify SCC without delay if such monitoring, testing, or participation has caused (or if Supplier expects it to cause) a problem or delay in an Implementation and will work with SCC to prevent or circumvent the problem or delay.

7.3 Deliverables. All Deliverables shall be tested for performance, compliance with Requirements, and ease of use or reference by Supplier prior to delivery to SCC. No update, engineering change, or revision made to a Deliverable shall degrade its performance below that established by the Requirements. Supplier warrants the interoperability of a Deliverable with all other Components of the Application and Solution.

7.3.1 Upon Supplier’s delivery of a Deliverable and certification that the Deliverable complies in all material respects to the Requirements, SCC may review and, if applicable, test such Deliverable to determine whether it is free from errors and defects and meets the technical, design, and functional specifications of all applicable Acceptance Criteria. Supplier acknowledges and agrees that SCC has broad discretion over the process and criteria for the review and testing of each Deliverable. The Review Period for each Deliverable will be thirty (30) Business Days after delivery (“Review Period”). Supplier will assist SCC throughout the Review Period, including by cooperating with SCC efforts, providing a technical Environment to facilitate SCC review, and providing applicable Documentation and information that may assist with SCC review and testing.

7.3.2. If Supplier receives a Deliverable Review Statement from SCC indicating rejection of a Deliverable, Supplier will provide a proposed corrective action plan within three (3) Business Days. The corrective action plan shall indicate Supplier’s plan to correct the Deliverable so that no Non-Conformities remain within ten (10) Business Days. Upon Supplier’s revision or correction of the Deliverable, Supplier will provide SCC with the revised Deliverable, whereupon the acceptance Review Period will be repeated.

7.4 Solution Acceptance. The Solution will be Accepted when SCC determines, following Acceptance testing, that the Solution operates in accordance with all Requirements and consistent with the Solution Description and the Acceptance Criteria. SCC shall have an Acceptance testing period of not less than ten (10) Business Days after Supplier’s deployment of the Solution in which to conduct testing. If SCC rejects the Solution as failing to meet all Acceptance Criteria and Agreement requirements, Supplier will provide a proposed corrective action plan within three (3) Business Days. The corrective action plan shall indicate Supplier’s plan to correct the Solution so that no Non-Conformities remain within ten (10) Business Days. Upon Supplier’s revision or correction of the Solution, the Solution Acceptance testing process will be repeated.

8 MAINTENANCE AND SUPPORT

Supplier shall provide all maintenance and Support Services required by the Agreement and Exhibit B (Solution Requirements), Exhibit C (Solution Description), and Exhibit D (Service Level Agreements).

9.2.2 When SCC Data is in Supplier’s possession or under Supplier’s control and an event occurs that prevents or hinders the access to or reliable use of such SCC Data, Supplier will re-create or restore such data immediately, or in any case, as soon as reasonably practicable, to the last scheduled back-up applicable to such SCC Data in accordance with Supplier’s responsibilities hereunder. Any such re-creation or restoration will be at Supplier’s expense.

9.2.3 Supplier shall always maintain and provide SCC with a secure method of exporting SCC Data when requested in an industry standard format that provides for interoperability and portability. The Services shall provide and maintain a backup of all SCC Data such that SCC Data can be recovered in an orderly and timely manner within a predefined frequency consistent with recovery time and recovery point objectives. The Services shall store a backup of SCC Data, at least daily, in an off-site “hardened” facility, located within the United States, maintaining the security of SCC Data. SCC will have the right to keep backup files for SCC Data. Supplier will provide SCC with downloads of SCC Data, as requested or directed by SCC, to enable SCC to maintain such backup copies. SCC Data will be returned or otherwise provided to SCC, upon request, in the form and format as requested by SCC.

9.2.4 Supplier will never refuse for any reason, including SCC’s material breach of the Agreement, to provide SCC with SCC Data.

9.3.2 Supplier shall have and maintain Business Continuity and Disaster Recovery Plans designed to maintain the access to the Services and to prevent the unintended destruction or loss of SCC Data. The Plans should provide a predefined frequency, consistent with recovery time and recovery point objectives, as specified in the Agreement, for disaster recovery and archival purposes of Content at a secure facility located within the United States.

9.4.2 Supplier shall notify SCC without undue delay, and in no event later than twenty-four (24) hours, after discovery of a Security Incident. Notification shall include all known details regarding the nature, scope, and actual, potential, and suspected impact of the Security Incident on the Solution, Application, Services, Content, and SCC Data.

9.4.3 Following a Security Incident, Supplier shall: (a) immediately initiate its incident response procedures; (b) take all reasonable steps to contain, mitigate, and remediate the Security Incident; (c) preserve all relevant evidence and logs; and (d) provide SCC with regular updates regarding Supplier’s investigation of the Security Incident that, depending on the nature of the incident, could be as frequent as hourly updates as determined by SCC in its sole discretion.

9.4.4 To the extent permitted by law, Supplier shall permit SCC the opportunity to participate in the investigation of the Security Incident and shall not limit SCC’s investigation of the nature, extent, and cause of the Security Incident.

9.4.5 For any Security Incident caused by the negligent acts or omissions of or breach of the Agreement by Supplier, Supplier will pay for any expenses to Supplier, SCC, and Third Parties as a result of the Security Incident, including the cost of any required legal compliance (e.g., notices required by applicable Laws), the expenses related to the investigation and remediation of the Security Incident, and any identity protection services.

10. DISPUTES AND CLAIMS (Code of Virginia § 2.2-4363) Claims, whether for money or other relief, shall be submitted by Supplier in writing to SCC Procurement Manager (“Procurement Manager”), no later than sixty (60) days after final payment; however, written notice of Supplier’s intention to file such claim must be given to the Procurement Manager at the time of the occurrence or beginning of the work upon which the claim is based and shall clearly state that it is a “notice of intent to make a claim.”

A claim shall clearly state that it is a “claim” and set forth the relief sought by Supplier, including any additional costs or damages claimed by Supplier and the basis for the relief requested, including the specific contractual basis upon which Supplier believes it is entitled to the relief requested. Failure to timely submit a notice of intent to make a claim, or to submit a claim, shall preclude any relief to Supplier.

The Procurement Manager shall render a final decision in writing within ninety (90) days after its receipt of Supplier’s written claim or within ninety (90) days after final payment, whichever date is later. The failure of the Procurement Manager to respond, or to timely respond, to a claim shall be deemed a denial of the claim by the Procurement Manager.

If Supplier’s claim is denied in whole or in part by the Procurement Manager, Supplier may request an administrative review of the final decision pursuant to SCC’s Procedure for Administrative Review of Procurement Decisions, dated October 6, 2015, available at Virginia SCC - Procurement. Supplier may not invoke review under these procedures prior to receipt of the Procurement Manager’s decision on a claim unless the Procurement Manager fails to timely render a decision.

Supplier’s remedies shall be limited to recovery of monetary damages and interest as may be allowed by law. In no event shall Supplier’s remedies include the right to terminate the Agreement, except as expressly provided herein.

The existence of a claim or an ongoing dispute resolution process shall not excuse Supplier from continuing performance under the Agreement or from properly complying with any changes ordered by SCC.

11 GENERAL TERMS & CONDITIONS

11.1 Applicable Law and Venue. This solicitation and any resulting contract shall be governed by the laws of the Commonwealth of Virginia and any litigation with respect thereto shall be brought in the Supreme Court of Virginia. Supplier shall comply with all applicable federal, state and local laws, rules, and regulations. Nothing in the Agreement will be construed to waive the Commonwealth’s sovereign immunity as it extends to SCC.

11.2 Authorized to Conduct Business. (Code of Virginia § 2.2-4311.2). Supplier, if organized as a stock or nonstock corporation, limited liability company, business trust, or limited partnership or registered as a registered limited liability…