0A1348_MCSA0129_Kelmar.pdf

Kelmar Unclaimed Property Services, LLC Master Cloud Services Agreement MCSA0129 Page 1 Unclaimed Property Management System resulting from RFP 0A1348

Form Date: 10.18.22

KELMAR ASSOCIATES, LLC D/B/A KELMAR UNCLAIMED PROPERTY SERVICES, LLC

MASTER CLOUD SERVICES AGREEMENT MCSA0129

FOR THE UNCLAIMED PROPERTY MANAGEMENT SYSTEM

RESULTING FROM RFP 0A1348

This Master Cloud Services Agreement MCSA0129 (“Contract”) is by and between Kelmar Associates, LLC d/b/a Kelmar Unclaimed Property Services, LLC (“Contractor” or “Kelmar”), having an office at 500 Edgewater Drive, Suite 525, Wakefield, Massachusetts 01880, and the State of Ohio (“State”), through its Department of Administrative Services (“DAS”), having its principal place of business at 30 East Broad Street, 40th Floor, Columbus, Ohio 43215. The State and the Contractor are sometimes referred to jointly as the "Parties" or individually as a “Party.” The effective date of this Contract is the date it is signed by the State.

1. General Information

1.1. Organization

This Contract covers subscriptions to cloud services set forth in the contract resulting from the Unclaimed Property Management System Request for Proposals #0A1348 (“Services”) that the Contractor makes available to the Subscriber. For purposes of this Agreement, if there are no Service Attachments, any references to the Service Attachment means the description of the Services contained in the contract resulting from the Unclaimed Property Management System Request for Proposals 0A1348. The Service Attachments describe the Services the Contractor offers under this Contract along with any special terms or conditions applicable only to those Services, descriptions of those Services, features, all fees associated with such Services, and any other provisions to which the Parties have agreed with respect to those Services. Such Service Attachments, when executed by the Parties, are attached as Exhibit I and incorporated into this Contract and become a part hereof.

1.2. Subscribers

A “Subscriber” means the Ohio Department of Commerce that places requests (“Orders”) through the State’s ordering system for the Services identified in the Service Attachments incorporated into this Contract. Any references to Cooperative Purchasing Members in this Contract are not applicable and considered stricken.

1.3. Reserved

1.4. Term

This Contract is effective on the date of final signature below. Unless earlier terminated as set forth herein, this Contract will expire on June 30, 2029.

1.5. Contract – Renewal

The State may renew this Contract by issuing written notice to the Contractor of the decision to do so. Renewals will be initiated by the State in writing before the expiration of the then-current term. This expiration and renewal procedure will also apply to the end of any subsequent renewal term.

1.6. Service Attachment(s) – Renewal

As part of the renewal of this Contract, the State may renew any or all Service Attachments under this Contract. Unless otherwise specified in the written renewal notice or in a Service

Kelmar Unclaimed Property Services, LLC Master Cloud Services Agreement MCSA0129 Page 2

Form Date: 10.18.22

Attachment, all Service Attachments are renewed upon the renewal of this Contract. Individual Orders under a Service Attachment may be renewed as long as the applicable Service Attachment remains in effect. Any such Order renewal is effective only on issuance of a purchase order from the Subscriber for the applicable Service. Pricing for this Contract is as set forth in Request for Proposals #0A1348. Any pricing beyond that provided in the RFP shall be mutually agreed upon by the Parties and established in writing via an amendment to the applicable Service Attachment which shall be attached and incorporated into this Contract.

The Subscribers have the option anytime during the Contract’s term to upgrade to a new technology or Service offering with the Contractor without incurring any fees for terminating the existing technology or Service early (“Early Termination Charge”), if any such charge is provided for in the applicable Service Attachment.

1.7. Relationship of the Parties and Subscribers

It is fully understood and agreed that Contractor is an independent contractor and is not an agent, servant, or employee of the State or any Subscriber. Contractor declares that it is engaged as an independent business and has complied with all applicable federal, state, and local laws regarding business permits and licenses of any kind, including but not limited to any insurance coverage, workers’ compensation, or unemployment compensation that is required in the normal course of business and will assume all responsibility for any federal, state, municipal, or other tax liabilities. Additionally, Contractor understands that as an independent contractor, it is not a public employee and is not entitled to contributions from the State to any public employee retirement system.

Contractor acknowledges and agrees any individual providing personal services under this Contract is not a public employee for purposes of Chapter 145 of the Ohio Revised Code. Unless Contractor is a “business entity” as that term is defined in Section 145.037 of the Ohio Revised Code (“an entity with five or more employees that is a corporation, association, firm, limited liability company, partnership, sole proprietorship, or other entity engaged in business”), Contractor will have any individual performing services under the Contract complete and submit to the Subscriber the Independent Contractor/Worker Acknowledgement form, available at https://www.opers.org/forms-archive/PEDACKN-Independent-Contractor-Worker- Acknowledgment.pdf.

Contractor’s failure to complete and submit the Independent Contractor/Worker Acknowledgement form prior to providing any Service or commencement of any work, service or deliverable, provided under this Contract, will serve as Contractor’s certification that Contractor is a “business entity” as the term is defined in R.C. 145.037.

1.8. Dealers and Distributors

The State authorizes the Contractor to name one or more dealers to work with the State on behalf of the Contractor. If the Contractor decides to use any dealers, the Contractor must submit to the State the name, principal business address, addresses for Orders and for payments, telephone number, and federal tax identification number of each dealer it wishes to name under this section.

The Contractor also must submit a completed W9 form for each dealer. The Contractor's submission must be on its official letterhead, signed by an authorized representative, and sent to the address listed in the Notices section of this Contract. Each named dealer must be properly registered in the Office of Budget and Management Shared Services via the Ohio Supplier Portal (supplier.ohio.gov) in order to receive payment under this Contract.

In doing the above, the Contractor warrants that:

https://www.opers.org/forms-archive/PEDACKN-Independent-Contractor-Worker-Acknowledgment.pdf https://www.opers.org/forms-archive/PEDACKN-Independent-Contractor-Worker-Acknowledgment.pdf

Kelmar Unclaimed Property Services, LLC Master Cloud Services Agreement MCSA0129 Page 3

Form Date: 10.18.22

i. The Contractor has provided the dealer with a copy of this Contract and a duly authorized representative of the dealer has agreed, in writing, to be bound by the terms and conditions in this Contract.

ii. The agreement with the dealer specifically provides that it is for the benefit of the State as well as the Contractor.

iii. The Contractor will remain liable under this Contract for the Services of its dealers and will remedy any breach of any of its dealers under this Contract.

iv. Payments under this Contract for the Services of any dealer may be made directly to that dealer, and the Contractor will look solely to the dealer for any payments due to the Contractor once the State has paid the dealer.

v. To the extent that there is any liability to the State arising from doing business with a dealer that has not signed the agreement required under this section with the Contractor, the Contractor will indemnify the State for such liability.

If the Contractor wants to designate a dealer that will not receive payments (a "distributor"), the Contractor may do so by identifying the person or organization as a distributor in the authorizing letter. In such cases, the taxpayer identification and payment address may be omitted from the authorizing letter, and a W9 form is not required. All other requirements and obligations for designating a dealer apply to designating a distributor.

1.9. State Audits and Reporting Requirements

1.9.1 State Audits

Contractor must keep all financial records related to this Contract in a manner consistent with Generally Accepted Accounting Principles (GAAP) or equivalent accounting principles. Additionally, Contractor must keep separate business records for this Contract, including records of disbursements and obligations incurred that must be supported by quotes, invoices, vouchers and other data as appropriate.

During the term of this Contract and for three years after its termination or expiration, on reasonable notice and during customary business hours, the State may audit the Contractor's records and other materials that relate to (i) the Services performed under this Contract, (ii) any billing or invoices under the Contract, or (iii) pricing representations that the Contractor made to acquire this Contract, and Contractor agrees to provide the State with access to and the right to examine any records or other materials involving transactions related to this Contract. This audit right also will apply to the State's duly authorized representatives and any organization providing funding for any Order hereunder.

The Contractor must make such records and materials available to the State within five business days after receiving the State’s written notice of its intent to audit the Contractor’s records, and must notify the State as soon as the records are ready for audit.

If any audit reveals any material misrepresentation, overcharge to the State, or violation of the terms of this Contract, the State will be entitled to recover its damages, including the cost of the audit.

1.9.2. Reserved

1.9.3. Other Reports

The State also may require various additional reports from the Contractor related to the Services. Such reports include those identified in any Service Attachment. Further, the

Kelmar Unclaimed Property Services, LLC Master Cloud Services Agreement MCSA0129 Page 4

Form Date: 10.18.22

State will be entitled to any other reports that the Contractor makes generally available to its other customers without additional charge. The State’s rights under this section will apply to all Services provided to all Subscribers under this Contract, but a Subscriber’s rights to reports will apply solely to Services it orders or receives under this Contract.

1.10. Subscribers’ Reliance on Contract

Subscribers may rely on this Contract. Whenever a Subscriber is a Cooperative Purchasing Member and relies on this Contract to issue an Order, the Subscriber will step into the shoes of the State under this Contract for purposes of its Order, and, as to the Subscriber's Order, this Contract will be between the Contractor and that Subscriber. The Contractor must look exclusively to that Subscriber for performance, including, but not limited to payment, and must hold the State harmless regarding such Orders and the Subscriber's performance. The State, through DAS, has the right to terminate this Contract and seek such remedies on termination as this Contract provides should the Contractor fail to honor its obligations under an Order from any Subscriber, whether a Cooperative Purchasing Member or not.

1.11. Subcontracting

The State recognizes that it may be necessary for the Contractor to use a subcontractor to perform a portion of the work under the Contract. In those circumstances, the Contractor shall submit a list identifying the Contractor’s subcontractors. The State approves of such subcontractors identified in Contractor’s response to Request for Proposals #0A1348 and Contractor does not need to submit those subcontractors for approval under this section. The Contractor may not enter into subcontracts related to the Contract after award without written approval from the State. If any change occurs during the term of the Contract that requires a change to identified subcontractors, the Contractor shall amend its list of subcontractors and request written approval from the State. The State shall have the right to reasonably approve or disapprove, after appropriate review of the subcontractor’s qualifications and/or interview(s), any and all subcontractors of the Contractor prior to their performance of Services. The State shall not unreasonably condition or withhold its approval of Contractor’s subcontractor staff. In the event the State does not approve of any such subcontractor staff, the State shall notify Contractor in writing of its reasonable basis for such action.

All subcontracts will be at the sole expense of the Contractor and the Contractor will be solely responsible for payment of its subcontractors. The Contractor assumes responsibility for all sub-contracting and third-party manufacturer work performed or product delivered under the Contract.

All agreements with subcontractors must incorporate this Contract by reference and include the following provisions: (1) the subcontractor agrees to be bound by all applicable terms and conditions of this Contract; and (2) the terms of this Contract prevail over any conflicting terms of the agreement with the subcontractor. The Contractor will be the sole point of contact with regard to all contractual matters.

1.12. Third-Party Suppliers

The Contractor must incorporate the costs of any third-party supplies and services in the Contractor’s fees identified on the applicable Service Attachment under this Contract.

The Contractor’s use of other suppliers does not mean that the State will pay for them. The Contractor will be solely responsible for payment of its suppliers and any claims of those suppliers for any failure of the Contractor to meet its obligations under this Contract or other agreement with the suppliers. The Contractor will hold the State harmless and indemnify the State against any such claims.

Kelmar Unclaimed Property Services, LLC Master Cloud Services Agreement MCSA0129 Page 5

Form Date: 10.18.22

The Contractor assumes responsibility for all Services provided under this Contract whether it or one of its suppliers provides them in whole or in part. Further, the Contractor will be the sole point of contact for all contractual matters, including payment of all charges resulting from the Contract and all Service requests.

1.13. Non-Exclusivity

This Contract is non-exclusive and is not a requirements contract. Nothing herein prevents either Party from entering into similar agreements with other entities.

1.14. Competitive Pricing and Services

For the purposes of maintaining pricing and Service competitiveness through the term of the Contract, the Contractor agrees to periodically review and discuss its pricing and Service offerings with the State upon request. The review may include a like-customer review wherein the Contractor would provide an analysis that includes both retail and wholesale prices of similar services it provides to other customers similar to the State to ensure the State and the Subscribers are receiving cost-competitive and technologically competitive Services. Requests for amendments to the Service Attachments to reduce fees and introduce technological Service improvements may be submitted by Contractor at any time throughout the term of the Contract.

1.15. Conflict Resolution

If one Party believes the other Party has violated or is not complying with the terms of this Contract or if any other dispute arises under this Contract, the Party raising the matter may provide to the other Party written notice referencing this section and specifying the nature of the dispute (the “Dispute Notification”). The Parties then will seek to resolve the dispute in accordance with the procedures in this section.

i. All disputes will be submitted first to the authorized State or Subscriber representative (or designee) and the Contractor’s representative for resolution. For 15 days from receipt of the Dispute Notification, the authorized State or Subscriber representative and Contractor’s representative will discuss and attempt to resolve the dispute in good faith.

ii. If after the 15 days identified above, the authorized State or Subscriber representative and the Contractor’s representative are unable to resolve the dispute, the Parties will then escalate the dispute to the proper State or Subscriber and Contractor representatives for resolution. For the next 15 days, the escalated State or Subscriber and Contractor representatives will discuss and attempt to resolve the dispute in good faith.

iii. If following the 15 days in the previous paragraph, the State’s or Subscriber’s and the Contractor’s escalated representatives are still unable to resolve the dispute, the Parties will then further escalate the dispute to the State’s Chief Information Officer (“CIO”) or a designee, or the equivalent Subscriber representative, and to the Contractor’s Vice President level for resolution. For the next 15 days, the State’s CIO or Subscriber representative and Contractor’s Vice President will discuss and attempt to resolve the dispute in good faith. If the State’s CIO or Subscriber representative and Contractor’s Vice President are unable to resolve the dispute within that time, the Parties will nevertheless continue to retain their rights to initiate formal proceedings hereunder.

The specific format for such discussions will be left to the discretion of the representatives of the State or Subscriber and Contractor responsible for attempting to resolve the dispute, but each Party will involve the business, technical, and legal resources reasonably necessary to attempt in good faith to resolve the dispute at the earliest possible time and without undue delay.

Kelmar Unclaimed Property Services, LLC Master Cloud Services Agreement MCSA0129 Page 6

Form Date: 10.18.22

If the Parties are unable to resolve the dispute and the dispute involves a claim that the Contractor is noncompliant with its obligations hereunder or has overcharged for a Service, the State or affected Subscribers may withhold payment for any Services that are the subject of the dispute until the Contractor cures the noncompliance, the Parties arrive at an agreement to resolve the dispute, or a Party obtains a resolution in a court of competent jurisdiction.

Nothing in this section is intended to limit the rights provided under the termination section of this Contract or be a prerequisite to exercising those rights.

Once the dispute has been resolved, any payments withheld will be handled in the following manner:

i. If the resolution was in favor of the State or one or more Subscribers, the Contractor will issue a credit on the next invoice for the affected Subscribers. If the credit exceeds the Service charges on the next invoice or an invoice will not be issued within 60 days of the resolution, the Contractor will issue payment in the form of a check in the amount exceeding the Service charges or for the full amount if an invoice will not be issued within 60 days. Any such checks must be issued within that 60-day period.

ii. If in favor of the Contractor, the affected Subscribers will submit appropriate payment within 30 days of receiving notification of the resolution at the office designated to receive the invoice and receiving a proper invoice.

iii. In either of the above cases, the amount or amounts withheld by the State or Subscriber(s) will be taken into account in calculating any amount(s) due.

2. General Requirements for Cloud Services

2.1. Standards

All Service subscriptions must provide a Service that maintains a redundant infrastructure that will ensure access for all the State’s enrolled users in case of a failure at any one of the Contractor locations, with effective contingency planning (including back-up and disaster recovery capabilities) and 24x7 trouble shooting service for inquiries, outages, issue resolutions, etc. All such Services must be dependable and provide response rates that are as good as or better than industry standards. They also must meet the Service Level Agreements (“SLAs”) provided in the applicable Service Attachment and the Contractor must issue any credits or refunds for any failure to meet the SLAs, as provided in the applicable Service Attachment. The Services must also be supported with sufficient connectivity and computing resources to handle reasonably anticipated peak demand and the Contractor must ensure that sufficient bandwidth and computing resources are dedicated to the Services to meet peak demand times without material degradation in performance.

All Services must operate at the moderate level baseline as defined in National Institute of Standards and Technology (“NIST”) Special Publication 800-53, “Security and Privacy Controls for Federal Information Systems and Organizations” (current, published version), be consistent with Federal Information Security Management Act (FISMA) requirements, and offer a customizable and extendable capability based on open-standards APIs that enable integration with third party applications. The Services must provide the State’s systems administrators with 24x7 visibility into the Services through a real-time, web-based “dashboard” capability that enables them to monitor, in real or near real time, the Services’ performance against the established SLAs and promised operational parameters.

The Contractor has and will continue to use its best efforts through quality assurance procedures to ensure that there are no viruses, malware, or undocumented features in its infrastructure and Services and that they do not contain any embedded device or code (e.g., time bomb) that is

Kelmar Unclaimed Property Services, LLC Master Cloud Services Agreement MCSA0129 Page 7

Form Date: 10.18.22 intended to obstruct or prevent any use of or access to them by the Subscribers. The Contractor hereby waives under any and all circumstances any right it may have or may hereafter have to exercise electronic self-help during the term of the subscription to the Services.

User access to the Services must be capable of using SAML or OpenID Connect protocols to securely federate with the State’s identity provider service in order to: (i) support single sign-on capability for users; (ii) ensure that every user is tied to an identity provider account; and (iii) prevent user access when a user is disabled or deleted in the applicable identity provider user store. Active Directory or other LDAP services should be used only as an alternative if SAML or OpenID Connect are unavailable.

2.2. Contractor Audit Requirements

The Contractor must obtain an annual audit of the Services that meets the American Institute of Certified Public Accountants (AICPA) Statements on Standards for Attestation Engagements (SSAE) No. 18, Service Organization Control 2 Type 2. The audit must cover all operations pertaining to the Services covered by this Contract. The audit will be at the sole expense of the Contractor and the results must be provided to the State within 30 days of Contractor’s receipt of its audit results each year.

At no cost to the State, the Contractor must immediately remedy any issues, material weaknesses, or other items identified in each audit as they pertain to the Services.

2.3. State Supplements 2 and 3

Contractor must comply with Supplement 3, State Information Security and Privacy Requirements, State Data Handling Requirements, the form of which is attached to Request for Proposals #0A1348. Supplement 3, as modified by Contractor’s responses therein and as mutually agreed upon by the Parties, is incorporated into this Contract as if fully rewritten herein.

Contractor must comply with Supplement 2, State IT Policy, Standard and Service Requirements, the form of which is attached to Request for Proposals #0A1348. Supplement 2, as modified by Contractor’s responses therein and as mutually agreed upon by the Parties, is incorporated into this Contract as if fully rewritten herein.

Contractor may be required to complete a new Supplement 2 and/or 3 for additional products, Services or Service Attachments under this Contract, and each new Supplement 2 and/or 3, as modified by Contractor’s responses therein and as mutually agreed upon by the Parties, is incorporated into this Contract as if fully rewritten herein.

2.4. Object Reassignment

Any Service subscriptions that are provided by the number of items that may be used by or in conjunction with it, such as nodes, users, or connections (“Objects”), may be reassigned to other, similar Objects within the Subscriber’s organization at any time and without any additional fee or charge. For example, a named user subscription may be assigned to another user. Any such reassignment must be in conjunction with termination of use by or with the previous Object, if such termination is required to keep the total number of licensed Objects within the scope of the applicable subscription. Should a Subscriber require a special code, unique key, or similar item to reassign the subscription as contemplated by this section, the Contractor will provide such a code, key, or similar item to the Subscriber at any time and without a fee or charge. For clarity, a later section in this Contract governs assignment of a Service subscription to a successor in interest.

Kelmar Unclaimed Property Services, LLC Master Cloud Services Agreement MCSA0129 Page 8

Form Date: 10.18.22

2.5. Generated Files

“Generated Files” are files storing information, instructions, or data that a Subscriber creates or modifies using the Services and in which the data or other information was provided or created by a Subscriber. Such Generated Files are also included in the definition of “Subscriber Data” in a later section of this Contract. Examples of Generated Files include, among others, text files generated with a word processor, data tables created with a database engine, and image files created with a graphics application. Applications consisting of instruction sets created with a programming language that the Contractor provided to a Subscriber also would be considered Generated Files. As between the Subscriber and the Contractor, the Subscriber will own all Generated Files that the Subscriber prepares by using the Services, excluding such portions of the Generated Files that consist of embedded portions of Contractor software. The Contractor or its licensors will retain ownership of any portion of software embedded into Generated Files, but the Contractor grants to the Subscriber a nonexclusive, royalty-free right to reproduce and distribute to third parties any portions of the software embedded in any Generated Files that the Subscriber creates while using the Services in a way the Services are designed to be used. In the Subscriber’s distribution of the Generated Files, the Subscriber may not use the Contractor’s name, logo, or trademarks, except to the extent that such are incorporated in such Generated Files by the design of a Service when used as intended.

2.6. Contractor Warranties

The Contractor warrants the following:

i. It has validly entered into this Contract and has the legal power to do so.

ii. The Services will perform materially in accordance with the applicable user guide, technical materials, related writings, and the requirements of this Contract.

iii. Subject to any limitations specified in the applicable Service Attachment, the functionality of the Services will not be materially decreased during a subscription term.

iv. It will not transmit viruses, worms, time bombs, Trojan horses or other harmful or malicious code, files, scripts, agents or programs (“Malicious Code”) to a Subscriber.

For any breach of a warranty above, the State’s and individual Subscribers’ remedies will be as provided in the section of this Contract dealing with termination.

Contractor also warrants that:

i. The recommendations, guidance, and performance of the Contractor under this Contract will be in accordance with the industry’s professional standards, the requirements of this Contract and without any material defect.

ii. No Service will infringe on the intellectual property rights of any third party.

iii. All warranties are in accordance with the Contractor’s standard business practices.

iv. The Services comply with all governmental, environmental and safety standards.

v. Contractor has the right to enter into this Contract.

vi. The Contractor has not entered into any other contracts or employment relationships that restrict the Contractor’s ability to perform under this Contract.

vii. The Contractor will observe and abide by all applicable laws and regulations, including those of the State regarding conduct on any premises under the State’s control.

viii. The Contractor has good and marketable title to any Service or related equipment delivered under this Contract for which title passes to the State.

ix. The Contractor has the right and ability to grant the license granted in any Service for which title does not pass to the State.

x. The Contractor has not and will not enter into any other contracts without written approval of the State to perform or provide substantially identical Services to the State such that it is duplicative of this Contract.

Kelmar Unclaimed Property Services, LLC Master Cloud Services Agreement MCSA0129 Page 9

Form Date: 10.18.22

The Contractor must notify the State in writing immediately upon the discovery of any breach of the warranties given above, or if any work of the Contractor or any Service fails to comply with these warranties, and the Contractor is so notified in writing, the Contractor will correct such failure in a commercially reasonable time or as specified in the Contract. If the Contractor fails to comply, the Contractor will refund the amount paid for the impacted Service(s). The Contractor will also indemnify the State for any direct damages and claims by third parties based on breach of these warranties.

OTHER THAN AS EXPRESSLY PROVIDED ABOVE, CONTRACTOR HEREBY EXPRESSLY

DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, WITHOUT

LIMITATION, ANY IMPLIED WARRANTY OF MERCHANTABILITY, IMPLIED WARRANTY OF

SATISFACTORY QUALITY, AND ANY IMPLIED WARRANTY OF FITNESS FOR A

PARTICULAR PURPOSE. EXCEPT AS EXPRESSLY PROVIDED IN WRITING HEREIN,

THERE IS NO WARRANTY THAT THE SOFTWARE DELIVERABLES OR ANY INFORMATION,

COMPUTER PROGRAM, EFFORTS OR ANY SYSTEM PROVIDED BY CONTRACTOR WILL

FULFILL ANY PARTICULAR PURPOSES OR NEEDS OF THE STATE.

Failure of the Contractor to meet any SLAs in an applicable Service Attachment will not be considered a breach of this warranty section unless the State reasonably determines that the failure is persistent or extended in duration.

2.7. State and Subscribers Responsibilities

The State and each Subscriber will be responsible for their respective compliance with this Contract. Additionally, each Subscriber will:

i. Be responsible for the accuracy, quality, and legality of its data and of the means by which the data was acquired;

ii. Use commercially reasonable efforts to prevent unauthorized access to or use of the Services to which it subscribes and notify the Contractor promptly of any unauthorized access or use of which it becomes aware; and

iii. Use the Services only in accordance with the applicable license terms, including specifically those set forth in Exhibit I – Service Attachment #1, the Documentation (defined in Service Attachment #1), and user guides, to the extent it is not inconsistent with this Contract, applicable laws, or government regulations.

A Subscriber may not:

i. Intentionally permit any third party to access or make the Services available to anyone other than its employees and contractors acting on its behalf (subject to any limitation contained in the Service Attachment) unless the applicable Service(s) is designed to be publicly-facing or intended for interaction with clients of the Subscriber (e.g., hosted websites), or as otherwise specifically permitted herein;

ii. Sell, resell, market, rent or lease the Services;

iii. Make copies, translations, adaptations, or modifications of or to the Services or any portion thereof, except as expressly agreed in writing by the Parties;

iv. Create derivative works based on the Services or hire, direct, influence or aid any other person or entity to do or to attempt to do so except as permitted herein.

v. Reverse engineer the Services and/or disassemble, or decompile the Services or the

Documentation or any portion thereof or attempt to do so, or otherwise attempt to discover the source code, any algorithms, methods, and/or techniques incorporated into the Services, and shall not hire, direct, influence or aid any other person or entity to do or attempt to do the same;

vi. Use or access the Services to build a competitive product or service or to copy any features, functions, or graphics of the Services;

Kelmar Unclaimed Property Services, LLC Master Cloud Services Agreement MCSA0129 Page 10

Form Date: 10.18.22

vii. Use the Services to store or transmit infringing, libelous, or otherwise unlawful or tortious material, or to store or transmit material in violation of third-party privacy rights;

viii. Intentionally use the Services to store or transmit Malicious Code;

ix. Intentionally interfere with or disrupt the integrity or performance of the Services or third-party data contained therein; or

x. Attempt to gain unauthorized access to the Services or their related systems or networks.

3. Insurance, Indemnification, Limitation of Liability

3.1. Insurance

Until all obligations under this Contract are satisfied, and without limiting Contractor’s indemnification obligations herein, Contractor shall procure and maintain, for the duration of the Contract, the insurance policies set forth below. Contractor shall procure and maintain insurance against claims for injuries to persons or damages to property which may arise from or in connection with the performance of the services hereunder by the Contractor, its agents, representatives, or employees. Contractor shall also procure and maintain insurance for claims arising out of their services including, but not limited to, loss, damage, theft or other misuse of data, infringement of intellectual property, invasion of privacy and breach of data. All commercial insurance required shall be provided by insurers with a rating of not less than A-VII from A.M.

Best or a comparable rating agency.

Coverage must be at least as broad as:

i. Commercial General Liability: written on an “occurrence” basis, including products and completed operations, property damage, bodily injury and personal and advertising injury with limits no less than $1,000,000 per occurrence. If a general aggregate limit applies, either the general aggregate limit will apply separately to this project/location or the general aggregate limit will be twice the required occurrence limit. Defense costs will be outside the policy limit. The State of Ohio, its officers, officials and employees are to be covered as additional insureds on the commercial general liability policy with respect to liability arising out of work or operations performed by or on behalf of the Contractor including materials, parts, or equipment furnished in connection with such work or operations.

ii. Automobile Liability: covering Code 1 (any auto), or if Contractor has no owned autos, Code 8 (hired) and 9 (non-owned), with a limit no less than $1,000,000 per accident for bodily injury and property damage.

iii. Workers’ Compensation insurance as required by the State of Ohio, or the state in which the work will be performed, with Statutory Limits, and Employer’s Liability Insurance with a limit of no less than $1,000,000 per accident for bodily injury or disease. If Contractor is a sole proprietor, partnership or has no statutory requirement for workers’ compensation, Contractor must provide a letter stating that it is exempt and agreeing to hold the State and Subscribers harmless from loss or liability for such.

iv. Technology Errors and Omissions and Cyber Liability Insurance with limits not less than $5,000,000 per occurrence or claim, $5,000,000 aggregate. Coverage shall be sufficiently broad to respond to the duties and obligations as are undertaken by Contractor in this Contract and shall cover all applicable Contractor personnel or subcontractors who perform professional services related to this Contract. Coverage shall include, but not be limited to, infringement of copyright, trademark, trade dress, invasion of privacy violations, information theft, damage to or destruction of electronic information, release of private information, alteration of electronic information, extortion and network security. The coverage shall provide for breach response costs as well as regulatory fines and penalties and credit monitoring expenses with sub-limits sufficient to respond to

Kelmar Unclaimed Property Services, LLC Master Cloud Services Agreement MCSA0129 Page 11

Form Date: 10.18.22 these obligations. This coverage requirement may be satisfied with any combination of policies, whether packaged or standalone, and include any applicable excess or umbrella coverage.

The insurance obligations under this Contract are the minimum insurance coverage requirements and/or limits shown in this Contract. Any insurance proceeds in excess of or broader than the minimum required coverage and/or minimum required limits, which are applicable to a given loss, will be available to the State of Ohio. No representation is made that the minimum insurance requirements of this Contract are sufficient to cover the obligations of the Contractor under this Contract.

Pursuant to Ohio Revised Code 2743.02(D), all applicable insurance or other means of recovery shall apply to any claim arising from the Contractor’s activities relating to this Contract on a primary basis. The insurance or self-insurance maintained by the State shall not contribute to claims made due to the Contractor’s negligence, errors, or omissions. No subrogation demands shall be made against the State of Ohio, except where there is negligence on the part of the State, and any such demands shall be reduced by all collateral recovery sources available to or received by the claimant.

Umbrella or Excess Insurance Policies. Umbrella or excess commercial liability policies may be used in combination with primary policies to satisfy the limit requirements above. Such Umbrella or excess commercial liability policies must apply without any gaps in the limits of coverage and be at least as broad as and follow the form of the underlying primary coverage required above.

Notice of Cancellation. Contractor must provide the State of Ohio with written notice of cancellation or material change to any insurance policy required above as soon as possible and must use best efforts to notify the State at least 30 days in advance of such cancellation or material change. Material change is defined as any change to the insurance limits, terms or conditions that would limit or alter the State’s available recovery under any of the policies required above. A lapse in any required insurance coverage during this Contract will be a breach of this Contract.

Deductibles and Self-Insured Retentions. Deductibles and self-insured retentions must be declared to and approved by the State. The State may require the Contractor to provide proof of ability to pay losses and related investigations, claims administration and defense expenses within the retention.

Claims Made Policies. If any of the required policies provide coverage on a claims-made basis:

i. The Retroactive Date must be shown and must be before the date of the Contract or the beginning of contract work.

ii. Insurance must be maintained and evidence of insurance must be provided for at least five (5) years after completion of the contract work.

iii. If coverage is canceled or non-renewed, and not replaced with another claims-made policy form with a Retroactive Date prior to the Contract effective date, the Contractor must purchase “extended reporting’’ coverage for a minimum of five (5) years after completion of contract work. The Discovery Period must be active during the Extended Reporting Period.

Verification of Coverage. Contractor must furnish the State of Ohio with certificates of insurance or copies of the applicable policy language effecting coverage required by this clause.

Kelmar Unclaimed Property Services, LLC Master Cloud Services Agreement MCSA0129 Page 12

Form Date: 10.18.22

All certificates are to be received and approved by the State of Ohio before work commences.

However, failure to obtain the required documents prior to the work beginning will not waive the Contractor’s obligation to provide them. The State of Ohio reserves the right to require complete, certified copies of all required insurance policies, including endorsements required by these specifications, at any time.

Subcontractors. Contractor must require and verify that all subcontractors maintain insurance with sufficient limits for the nature of the products or services they are providing, and Contractor shall ensure that State of Ohio is an additional insured on commercial general liability insurance required from subcontractors. Contractor will indemnify the State for damages that exceed a subcontractor’s policy limits.

Special Risks or Circumstances. State of Ohio reserves the right to modify these requirements, including limits, based on the nature of the risk, prior experience, insurer, coverage, or other special circumstances.

3.2. Indemnification

The Contractor must indemnify the State and Subscribers for all liability and expense resulting from bodily injury to any person (including injury resulting in death) or damage to State or Subscriber property arising out of the performance of this Contract, provided that such bodily injury or property damage is due to the negligence or other tortious conduct of the Contractor, its employees, agents, or subcontractors. The Contractor will not be responsible for any damages or liability for bodily injury or property damage to the extent caused by the negligence or willful misconduct of the State, a Subscriber, its employees, other contractors, or agents.

Contractor must indemnify the State and Subscribers for all liability and expense resulting from the unauthorized disclosure or loss of Subscriber Data. Damages resulting from the unauthorized disclosure or loss of Subscriber Data will be considered direct damages under this Contract and include, but are not limited to, the following: (i) expenses for legally-required notification of impacted individuals; (ii) responding to inquiries from such notifications; (iii) government fines and penalties assessed against the State and/or Subscribers; (iv) costs to the State and/or Subscribers for investigations, audits or forensic services as applicable related to the disclosure or loss; (v) mitigation measures, including 12 months of credit monitoring and identity theft protection for individuals impacted by a disclosure; (vi) costs to the State and/or Subscribers to reconstruct data that was lost or to repair any damaged State or Subscriber information technology infrastructure; and (vii) other such expenses incurred by the State and/or Subscribers as a result of the unauthorized disclosure or loss of Subscriber Data. Regardless of any limitation on liability of any kind in this Contract, the Contractor will be responsible for acquiring one year’s identity theft protection services on behalf of any individual or entity whose personally identifiable information is compromised while it is in the Contractor’s possession. Contractor’s indemnification obligations under this paragraph apply whether the expenses or costs incurred by the State are performed by State employees or hired contractors.

3.3. Indemnification for Infringement

Contractor must indemnify release, protect, and hold the State and the Subscribers harmless from any claim of infringement of a copyright, patent, trade secret, or similar intellectual property right based on the State’s proper use of any Service provided under this Contract. This obligation of indemnification will not apply where the State has modified or misused the Deliverable and the claim of infringement is based on the modification or misuse. If a successful claim of infringement is made, or if the Contractor reasonably believes that an infringement claim that is pending may actually succeed, the Contractor must take one of the following four actions within an acceptable timeframe:

Kelmar Unclaimed Property Services, LLC Master Cloud Services Agreement MCSA0129 Page 13

Form Date: 10.18.22

i. Modify the offending Service so that it is no longer infringing but provides substantially the same functionality as before the modification;

ii. Replace the offending Service with an equivalent or better non-infringing offering;

iii. Acquire the right for the Subscribers to use the infringing Service as it was intended to be used under this Contract; or

iv. Terminate the infringing Service and refund the amount the Subscribers paid for the

Service and the amount of any other Service that requires the availability of the infringing Service for it to be useful to the Subscribers.

The State agrees to give the Contractor notice of any such claim as soon as reasonably practicable and to give the Contractor the authority to settle or otherwise defend any such claim upon consultation with and approval by the Office of the Ohio Attorney General.

3.4. Limitation of Liability – State

The State and Subscribers’ combined total liability for damages, whether in contract, law, or equity, will not exceed two times the amount of compensation payable to Contractor for the previous 12 months of Service related to the Service Attachment under which the damages occurred, or the amount of direct damages incurred by the Contractor, whichever is less.

3.5. Limitation of Liability – Contractor

The Parties agree as follows:

i. Neither party will be liable for any indirect, incidental or consequential loss or damage of any kind including but not limited to lost profits, even if the parties have been advised, knew, or should have known of the possibility of damages.

ii. Notwithstanding any other limitation provisions, the Contractor agrees that the Contractor will be liable for all direct loss or damages due to the negligence or other tortious conduct of the Contractor under this Contract.

iii. Any limitation provisions contained in the documents and materials incorporated by reference into this Contract are considered stricken and of no force and effect.

4. Confidentiality and Handling of Data

4.1. Confidentiality

The parties may disclose or learn of information, documents, data, records, or other material that the disclosing party considers confidential (“Confidential Information”) in the performance of this Contract. The receiving party must treat the Confidential Information as such if it is so marked, otherwise defined as such, or when, by its very nature, it deals with matters that, if generally known, would be damaging to the best interests of either party, the public, other parties, or individuals or organizations about whom the disclosing party keeps information. Title to the Confidential Information and all related materials and documentation remains with the disclosing party. The receiving party may only use the Confidential Information solely to perform its obligations under this Contract and may not use or disclose any Confidential Information received as a result of this Contract without the written permission of the disclosing party. The Contractor must assume that all State information, documents, data, source codes, software, models, know-how, trade secrets, or other material when, by its very nature, it deals with matters that, if generally known, would be damaging to the best interest of the public, other parties, or individuals or organizations about whom the State keeps information is confidential. In addition, the receiving party may not use or disclose any documents or records excluded by Ohio law from public records disclosure requirements.

Kelmar Unclaimed Property Services, LLC Master Cloud Services Agreement MCSA0129 Page 14

Form Date: 10.18.22

If any Service delivered under this Contract contains data, documentation, or other written information that is confidential in nature and properly labeled as such, then it also will be Confidential Information for purposes of this section. The State will keep all such Confidential Information in confidence and will not use it other than as authorized under this Contract. The State will also not disclose any such Confidential Information to any third party without first obligating the third party to maintain the secrecy of the Confidential Information.

The receiving party’s obligation to maintain the confidentiality of the Confidential Information will not apply where the information:

i. Was already in the receiving party’s possession without the obligation of confidence;

ii. Is independently developed by the receiving party with documentary evidence to support the independent development;

iii. Is or becomes publicly available without breach of this Contract, except as provided in the next full paragraph;

iv. Is rightfully received by the receiving party from a third party without an obligation of confidence;

v. Is disclosed by the receiving party with the written consent of the disclosing party; or

vi. Is released in accordance with a valid order of a…