12-816192-Ex-IT-ConsultantAccess-DisclosureAgrmt.docx

EXHIBIT IT-1

ACCESS AND USE AGREEMENT

CAPITAL METROPOLITAN TRANSPORTATION AUTHORITY

RFP 816192 (01/06/2026) Page 1 of 10 Exhibit IT-1- ACCESS AND USE AGREEMENT This Access and Use Agreement (this “Agreement”) is entered into as of the effective date set forth on the signatory page between the undersigned person identified as the “Contractor” and Capital Metro Transportation Authority (“CapMetro”) concerning the terms and conditions under which CapMetro will provide the Contractor with limited access and use of CapMetro Data and/or CapMetro Electronic Property in conjunction with the Contractor’s performance of the Contract. The parties acknowledge and agree to the following terms and conditions:

DEFINITIONS

For purposes of this Agreement, capitalized terms shall have the meaning set forth below:

(a) “Applicable Laws” means any and all applicable statutes, laws, treaties, rules, codes, ordinances, regulations, permits, interpretations, or orders of any Federal, state, or local governmental authority having jurisdiction over CapMetro’s or the Contractor’s business the Contract, and the parties all as in effect as of the date of the Contract and as amended during the term of the Contract.

(b) “CapMetro Data” means all data, content or information, in any form or format, including interim, Processed, compiled, summarized, or derivative versions of such data, content or information, and any insights that may be learned from such data, content or information, that may exist in any system, database, or record that is either (i) provided by or on behalf of CapMetro or its customers to the Contractor, or (ii) is obtained, developed, produced or Processed by the Contractor or its systems, in each of (i) and (ii) in connection with the relationship or arrangements established by the Agreement, but excluding any data or information that is expressly defined as owned by the Contractor in the Contract.

(c) “CapMetro Electronic Property” means (i) any websites controlled by CapMetro, (ii) any CapMetro mobile device apps, (iii) any application programming interfaces (API) to CapMetro’s information technology systems, (iv) any other kiosks, devices or properties for consumer interaction that are created, owned, or controlled by CapMetro, and (v) versions and successors of the foregoing, any form or format now known or later developed, that may be used by customers obtaining products or services from CapMetro.

(d) “Confidential Information” as used herein, shall mean and include, without limitation: (i) any information concerning CapMetro, which is provided by or on behalf of CapMetro to the Contractor, such as accounting and financial data, product, marketing, development, pricing and related business plans and budgets, and all of the information and plans related to CapMetro’s business, which are not published; (ii) all CapMetro Data; and (iii) CapMetro Electronic Property.

(e) “Contract” means that certain contract for products and services entered into between the Contractor and CapMetro to which this Agreement is attached or incorporated by reference. The applicable reference number for the Contract may be set forth in the signatory page to this Agreement.

(f) “Remediation Efforts” means, with respect to any Security Incident, activities designed to remedy a Security Incident, which may be required by Applicable Law or by CapMetro’s or the Contractor’s policies or procedures or under the Security Requirements, or which may otherwise be necessary, reasonable or appropriate under the circumstances, commensurate with the nature of such Security Incident.

(g) “Security Incident” means: (i) the loss or misuse of CapMetro Data and/or CapMetro Electronic Property; (ii) the inadvertent, unauthorized, or unlawful processing, alteration, corruption, sale, rental, or destruction of CapMetro Data and/or CapMetro Electronic Property; (iii) unauthorized access to internal resources; (iv) programmatic manipulation of a system or network to attack a third party; (v) elevation of system privileges without authorization; (vi) unauthorized use of system resources; (vii) denial of service to a system or network; or (viii) any potential or confirmed exposure (which may stem from an act or omission to act) that would result in any of the events described in (i) through (viiii).

(h) “Security Requirements” means security measures under Applicable Laws, industry best practices and other reasonable physical, technical and administrative safeguards, procedures, protocols, requirements and obligations related to facility and network security in order to protect CapMetro Data and CapMetro Electronic Property from unauthorized processing, destruction, modification, distribution and use, as approved in writing by CapMetro, and all confidentiality and non-use or limited use obligations set forth in any license agreements or other third-party contracts (including interlocal agreement) applicable to CapMetro Data and/or CapMetro Electronic Property.

CONFIDENTIAL INFORMATION

The Contractor acknowledges and agrees that the Contract creates a relationship of confidence and trust on the part of the Contractor for the benefit of CapMetro. During the term of the Contract, the Contractor may acquire certain Confidential Information from or regarding CapMetro employees, agents and representatives or documents, or otherwise as a result of performing the services of the Contractor. The Contractor acknowledges and agrees that all such Confidential Information is and shall be deemed the sole, exclusive, confidential and proprietary property and trade secrets of CapMetro at all times during the term of the Contract and following any expiration of termination thereof.

STANDARD OF CARE

The Contractor agrees to hold in confidence without disclosing or otherwise using any Confidential Information, except as such disclosure or use may be required in connection with and limited to the product and services of the Contractor. The Contractor acknowledges and agrees that CapMetro would not have entered into the Contract unless CapMetro were assured that all such Confidential Information would be held in confidence by the Contractor in trust for the sole benefit of CapMetro.

EXCEPTIONS

The Contractor’s obligation of confidentiality hereunder shall not apply to information that: (i) is already in the Contractor’s possession without an obligation of confidentiality; (ii) is rightfully disclosed to the Contractor by a third party with no obligation of confidentiality; or (iii) is required to be disclosed by court or regulatory order, provided the Contractor gives CapMetro prompt notice of any such order.

COMPLIANCE

The Contractor, as well as its agents, representatives, and employees, shall comply with all of CapMetro’s rules, regulations, and guidelines pertaining to CapMetro Data and CapMetro Electronic Property and all Applicable Laws.

SECURITY REQUIREMENTS

The Contractor will establish and manage all Security Requirements necessary to protect CapMetro Data integrity and permit appropriate access to the Application and CapMetro Electronic Property. The Contractor will cooperate with and assist CapMetro and its contractors to implement security protocols (e.g., firewalls, SSI, etc.) and take appropriate actions with respect to all CapMetro Data and CapMetro Electronic Property to the extent in the Contractor’s access, possession or control, so as to enable the Contractor to prevent the loss, alteration or unauthorized access to CapMetro Data or CapMetro Electronic Property. The Contractor will, upon CapMetro's request, for each year of the term of the Contract, provide to CapMetro copies of monthly firewall logs and third party audit reports, summaries of test results and other equivalent evaluations with regard to security and confidentiality in connection with the Contractor’s access and use thereof The Contractor will use commercially reasonable efforts in accordance with the Security Requirements to secure all CapMetro Data and/or CapMetro Electronic Property stored on the Contractor’s devices or network against access by parties external to CapMetro or the Contractor and by unauthorized users, and against damage, disruption and other activity aimed at data availability or the services or other trespass or illegal actions. The Contractor will employ computer anti-malware protections and other reasonable commercial means to ensure a safe computing environment. The Contractor agrees that it will, and it will cause its personnel and contractors to timely comply with CapMetro's privacy policies and safety and network security policies, as the same may be provided to the Contractor, at all times while on-site at CapMetro's facilities or remotely accessing CapMetro's systems or facilities (including CapMetro Data and/or CapMetro Electronic Property). The Contractor and/or its designated third party auditor(s) will perform all audits necessary to ensure CapMetro Data integrity and adherence to the Security Requirements.

SECURITY INCIDENT

The Contractor will timely and promptly notify CapMetro upon discovering or otherwise learning of any Security Incident involving CapMetro Data but in no event shall such notice exceed the time periods for notice required under Applicable Laws. Following any Security Incident, the Contractor will consult in diligent good faith with CapMetro regarding Remediation Efforts that may be necessary and reasonable. Without limiting the foregoing, the Contractor will (i) immediately undertake investigations (internal or in cooperation with a governmental body) of such Security Incident, including forensics, (ii) timely share with CapMetro any Security Incident-related information, reports, forensic evidence and due diligence obtained from the investigation into the Security Incident and cooperate with CapMetro in response to regulatory, government and/or law enforcement inquiries and other similar actions, (iii) cooperate with CapMetro with respect to any public relations and other crisis management services, and litigation with respect to such Security Incident (including, but not limited to, class action suits or similar proceedings); and in each instance of Security Incident, be liable and responsible for payment of legal costs, disbursements, fines, settlements and damages. To the extent that CapMetro is bound to comply with any interlocal agreements pertaining to shared information (including CapMetro Data), the Contractor agrees that it will comply with, and cooperate with CapMetro in its compliance, with all rights and obligations pertaining to CapMetro Data under such interlocal agreements. The Contractor will timely and promptly notify CapMetro upon discovering or otherwise learning of any Security Incident involving CapMetro Data but in no event shall such notice exceed the time periods for notice required under Applicable Laws. Following any Security Incident, the Contractor will consult in diligent good faith with CapMetro regarding Remediation Efforts that may be necessary and reasonable. Without limiting the foregoing, the Contractor will (i) immediately undertake investigations (internal or in cooperation with a governmental body) of such Security Incident, including forensics, (ii) timely share with CapMetro any Security Incident-related information, reports, forensic evidence and due diligence obtained from the investigation into the Security Incident and cooperate with CapMetro in response to regulatory, government and/or law enforcement inquiries and other similar actions, (iii) cooperate with CapMetro with respect to any public relations and other crisis management services, and litigation with respect to such Security Incident (including, but not limited to, class action suits or similar proceedings); and in each instance of Security Incident, be liable and responsible for payment of legal costs, disbursements, fines, settlements and damages. To the extent that CapMetro is bound to comply with any interlocal agreements pertaining to shared information (including CapMetro Data), the Contractor agrees that it will comply with, and cooperate with CapMetro in its compliance, with all rights and obligations pertaining to CapMetro Data under such interlocal agreements.

LIMITED ACCESS AND USE

CapMetro authorizes the Contractor to access and use and to the extent necessary to perform the Services to install and use CapMetro Data and/or CapMetro Electronic Property provided or made available by CapMetro in its sole discretion and solely for the purposes of providing products and services for the benefit of or on behalf of CapMetro under and during the term of the Contract. As between the Contractor and CapMetro (i.e., without addressing rights of third parties), CapMetro is the sole owner of all rights, title and interest in and to any CapMetro Data and CapMetro Electronic Property, together with all improvements, derivative works or enhancements to any of the foregoing and all intellectual property rights related thereto. Except as expressly authorized in this Agreement in the performance of the services solely for the benefit of CapMetro or its customers, the Contractor may not use, edit, modify, create derivatives, combinations or compilations of, combine, associate, synthesize, re-identify, reverse engineer, reproduce, display, distribute, disclose, sell or Process any CapMetro Data or CapMetro Electronic Property. The Contractor will not use any CapMetro Data or CapMetro Electronic Property in a manner that is harmful to CapMetro. All access and use shall be subject to CapMetro’s platform and network security policies and procedures and other Security Requirements. Access and use shall be limited to the Contractor and the number of users or devices authorized in writing by CapMetro.

NO OWNERSHIP

Nothing set forth in this Agreement shall give the Contractor any ownership or other license, conveyance or right, title or interest in and to any and all Confidential Information (or any intellectual property, derivatives, improvements, enhancements, feedback or suggestions related to any of the foregoing, whether conceived, reduced to practice or developed alone or jointly with others by CapMetro or the Contractor), which rights shall be owned exclusively by CapMetro, and the Contractor will not knowingly take any action to challenge, contest or other action inconsistent with CapMetro's rights.

RESERVED RIGHTS

CapMetro reserves the right to suspend or terminate the Contractor’s access and use of CapMetro Data and/or CapMetro Electronic Property at any time without liability or prior notice to the Contractor. Within five (5) business days of CapMetro’s written request, the Contractor will return or destroy all written or recorded materials comprising any Confidential Information of CapMetro, together with all copies, summaries, compilations or analyses incorporating such information (whether held in computer, electronic or similar format), and certify the same in writing to CapMetro; provided that all confidentiality obligations and ownership rights shall survive the return of such materials and the termination of this Agreement indefinitely or for as long as such information qualifies as a trade secret or confidential information under applicable law.

SPECIFIC PERFORMANCE

The Contractor recognizes that the restrictions and covenants contained in this Agreement are reasonable and necessary for the protection of CapMetro’s legitimate business interests, goodwill and trade secrets and confidential information. The Contractor acknowledges that the breach or threatened breach of this Agreement can cause irreparable damages to CapMetro, and that in addition to and not in lieu of all other rights available at law or in equity, CapMetro will have the right to temporary and permanent injunctive relief to prevent the breach of this Agreement by the Contractor, without posting of bond and proving actual damages. CapMetro will be entitled to recover its costs and expenses, including reasonable attorneys' fees, in enforcing its rights under this Agreement.

MISCELLANEOUS

This Agreement is made under and shall be construed in accordance with the laws of the State of Texas, and any dispute arising under this Agreement shall be settled in a court of competent jurisdiction lying in Travis County, Texas. If any of the provision of this Agreement are found to be unenforceable, the remainder shall be enforced as fully as possible and the unenforceable provision shall be deemed modified to the limited extent required to permit enforcement of the Agreement as a whole. This Agreement may be signed in multiple counterparts by hard or electronic signature (each of which shall have the same force and effect and deemed an original but all of which will together constitute but one and the same instrument).

SIGNATURE BLOCK

CONTRACTOR

Capital Metro Transportation Authority

By:

Print Name:

Title:

Date:

Address:

Notice:

Contract No.

Footer Info: Exhibit IT- Access and Use Agreement for R F P, revised 07/12/2021, Page 4 of 4, end of document