Utah Tech University Supplemental Terms

UTAH TECH SUPPLEMENTAL TERMS

These Utah Tech Supplemental Terms are incorporated into the attached contract (the “Agreement’) as if fully set forth therein. To the extent any provisions of the Agreement conflict with any provisions of these Supplemental Terms, the provisions of the Supplemental Terms will control. References to this Agreement include the foregoing Agreement and these Supplemental Terms.

For purposes of these Supplemental Terms, “University” shall mean Utah Tech University and the term “Entity” shall mean the entity contracting with the University in the foregoing Agreement. All provisions of the Agreement that anticipate performance after the termination of the Agreement and all provisions necessary or appropriate to interpret and enforce such provisions, will survive termination of this Agreement.

1. Nondiscrimination; Equal Employment Opportunity: The parties agree to be bound by and comply with all applicable state and federal laws, rules, regulations, and executive orders governing equal employment opportunity, immigration, and nondiscrimination, including the Americans with Disabilities Act, and the terms and conditions of Section 601, Title VI, Civil Rights Act of 1964, in that “No person in the United States shall, on the grounds of race, color, national origin, or sex, be excluded from participation in, be denied the benefits of, or be subject to discrimination under any program or activity receiving Federal financial assistance.” In addition, “No otherwise qualified handicapped individual in the United States shall, solely by reason of his handicap, be excluded from the participation in, be denied the benefits of, or be subjected to discrimination under any program or activity receiving Federal financial assistance” (Section 504 of the Rehabilitation Act of 1973). Furthermore, for contracts involving federal funds, the applicable provisions and requirements of Executive Order 11246 as amended, Section 402 of the Vietnam Era Veterans Readjustment Assistance Act of 1974, Section 701 of Title VII of the Civil Rights Act of 1964, the Age Discrimination in Employment Act of 1967 (ADEA), 29 USC Sections 621, et seq., the Age Discrimination Act of 1975, Title IX of the Education Amendments of 1972, U.S. Department of Interior regulations at 43 CFR Part 17, and the Americans with Disabilities Action of 1990, are also incorporated into this Agreement. Specifically, the parties to this agreement and any subcontract shall abide by the requirements of 41 CFR 60-1.4(a), 60-300.5(a), and 60-741.5(a) where applicable. These regulations require that covered prime contractors and subcontractors take affirmative action to employ and advance in employment individuals without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or veteran status. The parties shall comply with pertinent amendments to such laws made during the term of the agreement and with all federal and state rules and regulations implementing such laws. This provision must be included in every subcontract relating to this agreement.

2. Failure of Legislature to Appropriate: The University is a public institution and this agreement shall in no way or manner be construed so as to bind or obligate the State of Utah or the University beyond the term of any particular appropriation of funds by the State of Utah Legislature as may exist from time to time. The University reserves the right to terminate this Agreement in whole or in part (or any order placed under it) if, in its sole judgment, the Legislature of the State of Utah fails, neglects, or refuses to appropriate sufficient funds as may be required for the University to continue such payments, or requires any return or “give-back” of funds required for the University to continue payments, or if the Executive Branch mandates any cuts or holdbacks in spending. All affected future rights and liabilities of the parties hereto shall thereupon cease within ten (10) calendar days after notice by the

University. Appropriation is a legislative act and is beyond control of the University.

3. Confidentiality: The University is a public institution and, as such, is subject to the Government Records Access and Management Act, Utah Code §63G-2-101 et seq., as may be amended from time to time (“GRAMA”). Accordingly, notwithstanding any other provision of this Agreement, any provision regarding confidentiality is limited to the extent necessary to comply with the provisions of GRAMA. Certain information or documents received by the University may be open to public inspection and copying unless exempt from disclosure.

4. Indemnification Limitation; Limit of University’s Liability:

The University is a public institution and, as such, the University’s liability is at all times limited as required by Utah law, including the Utah Governmental Immunity Act (Title 63G, Chapter 7, Utah Code Annotated, 1953, as amended) and any indemnification, limitation of Entity’s liability or hold harmless provision shall be void to the extent such provision violates applicable laws. Nothing in the agreement shall be deemed to constitute a waiver by University of any privilege, protection, or immunity otherwise afforded it under Utah law, or any other applicable law or a waiver of its sovereign immunity, which is hereby expressly retained.

Furthermore, the University shall at no time be liable for more than the pro rata share of the total damages awarded in favor of a claimant that is directly attributable to the negligent or otherwise wrongful acts or omissions of the University or its employees. Utah Tech University does not waive any procedural or substantive defense or benefit provided or to be provided by the Governmental Immunity Act or comparable legislative enactment, including without limitation, the provisions of Section 63G-7-604 regarding limitation of judgments. Any indemnity and insurance obligations incurred by the University under this contract are expressly limited to the amounts identified in the Act.

5. Indemnification by Entity: Entity will indemnify, defend, save and hold harmless Utah Tech University, its departments, agencies, boards, commissions, universities, and its officials, agents and employees (collectively, Indemnitee) for, from, and against any and all claims, actions, liabilities, damages, losses, or expenses (including court costs, attorneys’ fees, and costs of claim processing, investigation and litigation) for bodily injury or personal injury (including death), or loss or damage to tangible or intangible property to the extent caused, or alleged to be caused by the negligence, acts or omissions of Entity or any of its owners, officers, directors, members, managers, agents, employees or subcontractors, a breach of the agreement, or failure to comply with any applicable law.

6. Use of the University’s Name or Marks: Entity shall not prior to, in the course of, or after performance under this agreement, use University’s names, service marks, trademarks, trade names, logos or other identifying names, domain names, or identifying marks of University without the prior written consent of University.

7. Student Educational Records: Student educational records are protected by the federal Family Educational Rights and Privacy Act, 20 U.S.C. Section 1232g (FERPA). Entity will comply with FERPA and will not access or make any disclosure of student educational records to third parties without prior notice to and consent from the University or as otherwise provided by law. If the agreement contains a scope of work or any provision that requires or permits Entity to access or release any student records, then for purposes of this agreement only, University designates Entity as a “school official” for the University under FERPA, as that term is used in FERPA and its implementing regulations. As such, Entity will comply with FERPA and will not make any disclosure of University

Utah Tech University Supplemental Terms students’ educational records to third parties without prior notice to, and consent from, University, or as otherwise permitted by law.

In addition, any access or disclosures of student educational records made by Entity or its employees or agents must comply with University’s definition of legitimate educational purpose. If Entity violates this section, Entity will immediately provide notice of the violation to University. Entity further agrees to comply with all applicable federal, state, and local laws and regulations in regard to data privacy.

8. Governing Law; Venue: This Agreement shall be construed in accordance with and governed by the laws of the State of Utah, without regard to its conflict of law principles. Any action to enforce the provisions of this Agreement shall be brought in State district court in Washington County, Utah. The Parties hereby consent to jurisdiction of such courts. Federal grants and contracts shall also comply with the provisions of OMB Circular A-21(j) 32.

9. Compliance with University Policies: Entity will comply with all applicable University policies, available at https://utahtech.edu/policylibrary and any policies that may be posted at any University facility or venue.

10. Digital Accessibility: For contracts involving website services, digital content, software or software as a service, user interfaces, mobile apps, or similar products or services (collectively “Services”), Entity represents and warrants that Services will comply with all of its obligations under applicable federal disabilities laws and regulations, including without limitation the accessibility requirements of Section 508 of the Rehabilitation Act of 1973 and Title II of the Americans with Disabilities Act (ADA) (including the standards as required by the Department of Justice). Upon request by the University, Entity will provide a voluntary product assessment template (VPAT) regarding the compliance of the software applications and/or services provided by Entity. To the extent Entity becomes aware that any Services provided to University are not compliant with these standards, Entity agrees to promptly respond to, resolve and remediate any complaint regarding accessibility of its Services in a timely manner and to implement changes Entity deems reasonable in response to any complaints. Entity will provide an updated and compliant version to University at no cost within a commercially reasonable time. If Entity is unable to provide the Services in compliance with these standards, University may terminate the Agreement and neither party will have any further liability under the Agreement.

11. Data Ownership and Purge: Any and all data supplied to Entity by University or collected by Entity on behalf of University shall be considered University data (“University Data”) and University owns any and all rights thereto. At the conclusion of the Agreement term, Entity shall delete/purge any and all University Data. If this cannot be done, Entity must submit a statement detailing what University Data will be retained and the reasons why such University Data cannot be purged. Any retained University Data is subject to the same breach notification requirements, and must be maintained with the same level of confidentiality, privacy, and security as required by these Utah Tech Supplemental Terms.

12. Government Data Privacy Act: Entity understands and agrees that University is a governmental entity and is subject to the Government Data Privacy Act (“GDPA”) found in Utah Code Title 63A, Chapter 19. If Entity receives University Data that contains any personal data (as defined in GDPA), then as a condition of contracting with University, Entity also agrees to comply with the requirements of the GDPA with regard to the personal data processed or accessed by Entity to the same extent as required of University; including but not limited to: Entity shall only obtain and process the minimum amount of personal data reasonably necessary to efficiently achieve the specific purpose of Entity’s obligations under the Agreement, and Entity is prohibited from selling and/or sharing personal data without express written permission from University. This Agreement constitutes express written permission for Entity to share personal data and/or University Data as is necessary for Entity to fulfill its obligations under the Agreement, so long as Entity imposes the same privacy and security standards and purge requirements on any subcontractors. If Entity is collecting any personal data on University’s behalf, Entity further agrees to provide notice as outlined in Utah Code Section 63A-19- 402.

13. Security Standards, Privacy, and Breach: Entity agrees to safeguard any and all University Data and shall only use University Data in furtherance of Entity’s obligations under the Agreement.

Entity shall not share University Data without University’s prior written approval. Entity shall implement reasonable security controls to protect University Data. Entity will only process/store University Data within data centers located within the United States.

Entity agrees to provide, upon request, information regarding Entity’s security measures. In the event of a security breach or incident impacting University Data that is the result of a security failure on the part of Entity, University shall be notified as soon as is reasonably possible, but not longer than 5 days, and provided all known facts of the incident, including, but not limited to: the root cause of the incident, what data has been compromised, and what actions are being taken by Entity to respond to the incident.

14. Audits: Entity understands that University is governed by Utah Code Part 53H-14-5 and Utah System of Higher Education Rule 1011, and Entity hereby agrees to permit University, or University’s designee, at University’s request, to audit Entity and Entity’s security measures to verify compliance with data processing obligations and applicable legal provisions. Entity further agrees to comply with such an audit. University may, at its sole discretion, accept a HECVAT questionnaire and/or a SOC2 certification in lieu of conducting an audit.

15. Artificial Intelligence/Machine Learning Systems: Entity shall not use any University Data to train, develop, and/or improve its artificial intelligence products, other artificial intelligence system(s), and/or machine learning models or algorithms, without prior express written consent of University, even if University Data is anonymized.

ACCEPTANCE:

Company Name

Representative Name & Title

Signature

Date

Solicitation Title

Solicitation # (if applicable)