STATE OF MICHIGAN PROCUREMENT

Department Technology, Management and Budget Central Procurement Services 320 S Walnut Street Lansing, MI 48933 P.O. Box 30026, Lansing, MI 48909

NOTICE OF CONTRACT

NOTICE OF CONTRACT NO. 260000000670

between

THE STATE OF MICHIGAN

and

C O

N

TR

AC

TO

R

Kalamazoo X-Ray Sales, Inc. dba Data Guardian 9136 Portage Industrial Drive

Portage Michigan 49024

Kent White

269-492-7179 kwhite@kalamazooxray.com

CV0132085

ST

AT

E

Pr og ra m

M an ag er

Caryn Wojcik DTMB

517-335-8222 wojcikc@michigan.gov

C on tr ac t Ad m in is tr at or Nichole Harrell DTMB

517-449-9245 harrelln@michigan.gov

CONTRACT SUMMARY

DESCRIPTION: Confidential Records Destruction Services

INITIAL EFFECTIVE DATE

5/15/2026

INITIAL EXPIRATION DATE

5/14/2031

INITIAL AVAILABLE

OPTIONS

5 - 1 Year

EXPIRATION DATE BEFORE

CHANGE(S) NOTED BELOW

5/14/2031

PAYMENT TERMS

Net 45

DELIVERY TIMEFRAME

No Delivery Timeframe

ALTERNATE PAYMENT OPTIONS

P-card Payment Request (PRC) Other

EXTENDED PURCHASING

Yes No

MINIMUM DELIVERY REQUIREMENTS

No Minimum Delivery Requirements.

MISCELLANEOUS INFORMATION

This Contract Agreement is awarded on the basis of the State's inquiry bearing the solicitation number RFP 260000000795. Orders for delivery will be issued directly by the Department, in accordance with Schedule A, Section 6.1.

Authorizing Document.

ESTIMATED CONTRACT VALUE AT TIME OF EXECUTION $3,205,733.00

CONTRACT NO. 260000000670

FOR THE CONTRACTOR:

Company Name

Authorized Agent Signature

Authorized Agent (Print or Type)

Date

FOR THE STATE:

Signature

Name and Title

DTMB Central Procurement Services Agency

Date

Version 2025-2 Page 1 of 18

HYBRID CONTRACT TERMS

This HYBRID CONTRACT (“Contract”) is agreed to between the State of Michigan (the “State”) and Kalamazoo X-Ray Sales, Inc. d/b/a Data Guardian (“Contractor”), a Michigan Corporation. This Contract is effective on May 15, 2026 (“Effective Date”), and unless terminated, will expire on May 14, 2031 (the “Term”).

This Contract may be renewed for up to five (5) additional one-year period(s). Renewal is at the sole discretion of the State and will automatically extend the Term of this Contract. The State will document its exercise of renewal options via Contract Change Notice.

The parties agree as follows:

Duties of Contractor. Contractor must perform the services and provide the deliverables (the “Contract Activities”) described in a Statement of Work, the initial Statement of Work is attached as Schedule A – Statement of Work. An obligation to provide delivery of any commodity is considered a service and is a Contract Activity.

Contractor must furnish all labor, equipment, materials, and supplies necessary for the performance of the Contract Activities unless otherwise specified in a Statement of Work.

Contractor must: (a) perform the Contract Activities in a timely, professional, safe, and workmanlike manner consistent with standards in the trade, profession, or industry; (b) meet or exceed the performance and operational standards, and specifications of the Contract; (c) provide all Contract Activities in good quality, with no material defects; (d) not interfere with the State’s operations; (e) obtain and maintain all necessary licenses, permits or other authorizations necessary for the performance of the Contract; (f) cooperate with the State, including the State’s quality assurance personnel, and any third party to achieve the objectives of the Contract; (g) return to the State any State-furnished equipment or other resources in the same condition as when provided when no longer required for the Contract; (h) assign to the State any claims resulting from state or federal antitrust violations to the extent that those violations concern materials or services supplied by third parties toward fulfillment of the Contract; (i) comply with all State physical and IT security policies and standards which will be made available upon request; (j) comply with Internal Revenue Service Publication 1075; and (k) provide the State priority in performance of the Contract except as mandated by federal disaster response requirements. Any breach under this paragraph is considered a material breach.

Contractor must also be clearly identifiable while on State property by wearing identification issued by the State, and clearly identify themselves whenever making contact with the State.

Notices. All notices and other communications required or permitted under this Contract must be in writing and will be considered given and received: (a) when verified by written receipt if sent by courier; (b) when actually received if sent by mail without verification of receipt; or (c) when verified by automated receipt or electronic logs if sent by facsimile or email.

Version 2025-2 Page 2 of 18

If to State: If to Contractor:

See Contract Administrator information shown below.

Kent White 9136 Portage Industrial Drive Portage, MI 49024 kwhite@kalamazooxray.com 269-492-7179

Contract Administrator. The Contract Administrator, or the individual duly authorized for each party, is the only person authorized to modify any terms of this Contract, and approve and execute any change under this Contract (each a “Contract Administrator”):

State: Contractor:

Nichole Harrell 320 S Walnut St.

Lansing, MI 48933 Harrelln@michigan.gov 517-449-9245

Jim White 9136 Portage Industrial Drive Portage, MI 49024 jwhite@kalamazooxray.com 269-492-7178

Program Manager. The Program Manager for each party will monitor and coordinate the day-to-day activities of the Contract (each a “Program Manager”):

State: Contractor:

Caryn Wojcik 3400 N Grand River Ave Lansing, MI 48933 Wojcikc@michigan.gov 517-335-8222

Kent White 9136 Portage Industrial Drive Portage, MI 49024 kwhite@kalamazooxray.com 269-492-7179

Performance Guarantee. Contractor must at all times have financial resources sufficient, in the opinion of the State, to ensure performance of the Contract and must provide proof upon request. The State may require a performance bond (as specified in a Statement of Work) if, in the opinion of the State, it will ensure performance of the Contract.

Insurance Requirements. See Schedule C – Insurance Requirements.

Administrative Fee and Reporting. Contractor must pay an administrative fee of 1% on all payments made to Contractor under the Contract including transactions with the State (including its departments, divisions, agencies, offices, and commissions), MiDEAL members, and other states (including governmental subdivisions and authorized entities). Administrative fee payments must be made online by check or credit card at:

https://www.thepayplace.com/mi/dtmb/adminfee.

Contractor must submit an itemized purchasing activity report, which includes, at a minimum, the name of the purchasing entity and the total dollar volume in sales. Reports should be mailed to MiDeal@michigan.gov.

The administrative fee and purchasing activity report are due within 30 calendar days from the last day of each calendar quarter.

https://www.thepayplace.com/mi/dtmb/adminfee

Version 2025-2 Page 3 of 18

Extended Purchasing Program. This contract is extended to MiDEAL members. MiDEAL members include local units of government, school districts, universities, community colleges, and nonprofit hospitals. A current list of MiDEAL members is available at www.michigan.gov/mideal.

Upon written agreement between the State and Contractor, this contract may also be extended to: (a) other states (including governmental subdivisions and authorized entities) and (b) State of Michigan employees.

If extended, Contractor must supply all Contract Activities at the established Contract prices and terms for identical services. Service location, frequency, size of containers used/collected, collection method, material collected, or other factors that materially differ from the services provided to the State may affect pricing. The State reserves the right to impose an administrative fee and negotiate additional discounts based on any increased volume generated by such extensions.

Contractor must submit invoices to, and receive payment from, extended purchasing program members on a direct and individual basis.

Relationship of the Parties. The relationship between the parties is that of independent contractors. Contractor, its employees, and agents will not be considered employees of the State. No partnership or joint venture relationship is created by virtue of this Contract.

Contractor, and not the State, is responsible for the payment of wages, benefits and taxes of Contractor’s employees. Prior performance does not modify Contractor’s status as an independent contractor. Neither party has authority to contract for nor bind the other party in any manner whatsoever.

Reserved.

Reserved.

Reserved.

Reserved.

Reserved.

Staffing. The State’s Contract Administrator may require Contractor to remove or reassign personnel providing services by providing a notice to Contractor.

Disclosure of Subcontractors. Contractor is not permitted to use subcontractors in the performance of this agreement.

Background Checks. Pursuant to Michigan law, all agencies subject to IRS Pub. 1075 are required to ask the Michigan State Police to perform fingerprint background checks on all employees, including Contractor and Permitted Subcontractor employees, who may have unescorted access to records maintained by the State of Michigan that contains confidential or personal information, including, but not limited to, federal tax information. Further, pursuant to Michigan law, any agency described above is prohibited from providing Contractors or Permitted http://www.michigan.gov/mideal

Version 2025-2 Page 4 of 18

Subcontractors with the result of such background check. For more information, please see Michigan Public Act 427 of 2018. Upon request, or as may be specified in a Statement of Work, Contractor must perform background checks on all employees and subcontractors and its employees prior to their assignment. The scope is at the discretion of the State and documentation must be provided as requested. Contractor is responsible for all costs associated with the requested background checks. The State, in its sole discretion, may also perform background checks.

Assignment. Contractor may not assign this Contract to any other party without the prior approval of the State. Upon notice to Contractor, the State, in its sole discretion, may assign in whole or in part, its rights or responsibilities under this Contract to any other party. If the State determines that a novation of the Contract to a third party is necessary, Contractor will agree to the novation and provide all necessary documentation and signatures.

Change of Control. Contractor will notify the State, within 30 days of any public announcement or otherwise once legally permitted to do so, of a change in Contractor’s organizational structure or ownership. For purposes of this Contract, a change in control means any of the following: (a) a sale of more than 50% of Contractor’s stock; (b) a sale of substantially all of Contractor’s assets;

(c) a change in a majority of Contractor’s board members; (d) consummation of a merger or consolidation of Contractor with any other entity; (e) a change in ownership through a transaction or series of transactions; (f) or the board (or the stockholders) approves a plan of complete liquidation. A change of control does not include any consolidation or merger effected exclusively to change the domicile of Contractor, or any transaction or series of transactions principally for bona fide equity financing purposes.

In the event of a change of control, Contractor must require the successor to assume this Contract and all of its obligations under this Contract.

Ordering. Contractor is not authorized to begin performance until receipt of authorization as identified in a Statement of Work.

Acceptance. Contract Activities are subject to inspection and testing by the State within 30 calendar days of the State’s receipt of them (“State Review Period”), unless otherwise provided in a Statement of Work. If the Contract Activities are not fully accepted by the State, the State will notify Contractor by the end of the State Review Period that either: (a) the Contract Activities are accepted but noted deficiencies must be corrected; or (b) the Contract Activities are rejected. If the State finds material deficiencies, it may: (i) reject the Contract Activities without performing any further inspections; (ii) demand performance at no additional cost; or (iii) terminate this Contract in accordance with Section 28, Termination for Cause.

Within 10 business days from the date of Contractor’s receipt of notification of acceptance with deficiencies or rejection of any Contract Activities, Contractor must cure, at no additional cost, the deficiency and deliver unequivocally acceptable Contract Activities to the State. If acceptance with deficiencies or rejection of the Contract Activities impacts the content or delivery of other non-completed Contract Activities, the parties’ respective Program Managers must determine an agreed to number of days for re-submission that minimizes the overall

Version 2025-2 Page 5 of 18 impact to the Contract. However, nothing herein affects, alters, or relieves Contractor of its obligations to correct deficiencies in accordance with the time response standards set forth in this Contract.

If Contractor is unable or refuses to correct the deficiency within the time response standards set forth in this Contract, the State may cancel the order in whole or in part. The State, or a third party identified by the State, may perform the Contract Activities and recover the difference between the cost to cure and the Contract price plus an additional 10% administrative fee.

Delivery. Contractor must deliver all Contract Activities F.O.B. destination, within the State premises with transportation and handling charges paid by Contractor, unless otherwise specified in a Statement of Work. All containers and packaging become the State’s exclusive property upon acceptance.

Risk of Loss and Title. Until final acceptance, title and risk of loss or damage to Contract Activities remains with Contractor. Contractor is responsible for filing, processing, and collecting all damage claims. The State will record and report to Contractor any evidence of visible damage. If the State rejects the Contract Activities, Contractor must remove them from the premises within 10 calendar days after notification of rejection. The risk of loss of rejected or non-conforming Contract Activities remains with Contractor. Rejected Contract Activities not removed by Contractor within 10 calendar days will be deemed abandoned by Contractor, and the State will have the right to dispose of it as its own property. Contractor must reimburse the State for costs and expenses incurred in storing or effecting removal or disposition of rejected Contract Activities.

Warranty Period. The warranty period, if applicable, for Contract Activities is a fixed period commencing on the date specified in a Statement of Work. If the Contract Activities do not function as warranted during the warranty period, the State may return such non-conforming Contract Activities to the Contractor for a full refund.

Invoices and Payment. Invoices must conform to the requirements communicated from time-to-time by the State. All undisputed amounts are payable within 45 days of the State’s receipt.

Contractor may only charge for Contract Activities provided as specified in a Statement of Work.

Invoices must include an itemized statement of all charges. The State is exempt from federal excise tax, state, and local sales taxes, and use taxes if the Contract Activities purchased under this Contract are for the State’s exclusive use. Contractor will not include the collection of taxes for which the State is exempt in any invoices or payments related to this Contract. The State is not responsible for taxes imposed or assessed on Contractor.

The State has the right to withhold payment of any disputed amounts until the parties agree as to the validity of the disputed amount. The State will notify Contractor of any dispute within a reasonable time. Payment by the State will not constitute a waiver of any rights as to Contractor’s continuing obligations, including claims for deficiencies or substandard Contract Activities. Contractor’s acceptance of final payment by the State constitutes a waiver of all claims by Contractor against the State for payment under this Contract, other than those claims previously filed in writing on a timely basis and still disputed.

Version 2025-2 Page 6 of 18

The State will only disburse payments under this Contract through Electronic Funds Transfer (EFT). Contractor must register with the State at http://www.michigan.gov/SIGMAVSS to receive electronic fund transfer payments. If Contractor does not register, the State is not liable for failure to provide payment. Without prejudice to any other right or remedy it may have, the State reserves the right to set off at any time any amount then due and owing to it by Contractor against any amount payable by the State to Contractor under this Contract.

Excluding federal government charges and terms, Contractor warrants and agrees that each of the fees, economic or product terms or warranties granted pursuant to this Contract are comparable to or better than the equivalent fees, economic or product term or warranty being offered to any commercial or government customer (including any public educational institution within the State of Michigan) of Contractor. If Contractor enters into any arrangements with another customer of Contractor to provide the products or services, available under this Contract, under more favorable prices, as the prices may be indicated on Contractor’s current U.S. and International price list or comparable document, then this Contract will be deemed amended as of the date of such other arrangements to incorporate those more favorable prices, and Contractor will immediately notify the State of such fee and formally memorialize the new pricing in a change notice.

Liquidated Damages. Liquidated damages, if applicable, will be assessed as described in a Statement of Work. The parties understand and agree that any liquidated damages (which includes but is not limited to applicable credits) set forth in this Contract are reasonable estimates of the State’s damages in accordance with applicable law. The parties acknowledge and agree that Contractor could incur liquidated damages for more than 1 event. The assessment of liquidated damages will not constitute a waiver or release of any other remedy the State may have under this Contract for Contractor’s breach of this Contract, including without limitation, the State’s right to terminate this Contract for cause under Section 28 and the State will be entitled in its discretion to recover actual damages caused by Contractor’s failure to perform its obligations under this Contract. However, the State will reduce such actual damages by the amounts of liquidated damages received for the same events causing the actual damages. Amounts due the State as liquidated damages may be set off against any fees payable to Contractor under this Contract, or the State may bill Contractor as a separate item and Contractor will promptly make payments on such bills.

Stop Work Order. The State may suspend any or all activities under the Contract at any time.

The State will provide Contractor a written stop work order detailing the suspension. Contractor must comply with the stop work order upon receipt. Within 90 calendar days, or any longer period agreed to by Contractor, the State will either: (a) issue a notice authorizing Contractor to resume work, or (b) terminate the Contract or delivery order. The State will not pay for Contract Activities, Contractor’s lost profits, or any additional compensation during a stop work period.

Termination for Cause. (a) The State may terminate this Contract for cause, in whole or in part, if Contractor, as determined by the State: (i) endangers the value, integrity, or security of any facility, data, or personnel; (ii) becomes insolvent, petitions for bankruptcy court proceedings, or has an involuntary bankruptcy proceeding filed against it by any creditor; (iii) engages in any http://www.michigan.gov/SIGMAVSS

Version 2025-2 Page 7 of 18 conduct that may expose the State to liability; (iv) breaches any of its material duties or obligations under this Contract; or (v) fails to cure a breach within the time stated by the State in a notice of breach, if in its sole discretion the State has chosen to provide a time to cure. Any reference to specific breaches being material breaches within this Contract will not be construed to mean that other breaches are not material.

(b) If the State terminates this Contract under this Section, the State will issue a termination notice specifying whether Contractor must: (i) cease performance immediately or (ii) continue to perform for a specified period. If it is later determined that Contractor was not in breach of the Contract, the termination will be deemed to have been a Termination for Convenience, effective as of the same date, and the rights and obligations of the parties will be limited to those provided in Section 29, Termination for Convenience.

Contractor must submit all invoices for Contract Activities accepted by the State within 30 days of the date of termination. Failure to submit an invoice within that timeframe will constitute a waiver by Contractor for any amounts due to Contactor for Contract Activities accepted by the State under this Contract. The State will only pay for amounts due to Contractor for Contract Activities accepted by the State on or before the date of termination, subject to the State’s right to set off any amounts owed by the Contractor for the State’s reasonable costs in terminating this Contract. Contractor must promptly reimburse to the State any fees prepaid by the State prorated to the date of such termination, including any prepaid fees. The Contractor must pay all reasonable costs incurred by the State in terminating this Contract for cause, including administrative costs, attorneys’ fees, court costs, transition costs, and any costs the State incurs to procure the Contract Activities from other sources.

Termination for Convenience. The State may immediately terminate this Contract in whole or in part without penalty and for any reason or no reason, including but not limited to, appropriation or budget shortfalls. The termination notice will specify whether Contractor must: (a) cease performance of the Contract Activities immediately or (b) continue to perform the Contract Activities in accordance with Section 30, Transition Responsibilities. Contractor must submit all invoices for Contract Activities accepted by the State within 30 days of the date of termination.

Failure to submit an invoice within that timeframe will constitute a waiver by Contractor for any amounts due Contractor for Contract Activities accepted by the State under this Contract. If the State terminates this Contract for convenience, the State will pay all reasonable costs, as determined by the State, for State approved Transition Responsibilities to the extent the funds are available.

In addition, if the State terminates this Contract for convenience, the State will pay:

1. Unrecovered, pre-approved, non-recurring implementation costs, amortized on a straight-line basis over sixty (60) months from the Effective Date (“Amortization Period”).

For purposes of this Section:

• “Non-Recurring Implementation Costs” means documents, reasonable, and necessary one-time costs incurred by Contractor specifically to implement this Contract, including

Version 2025-2 Page 8 of 18 transition in labor, configuration, integration, equipment acquisition dedicated to this Contract, and other mutually agreed start-up expenses.

• Such costs will be submitted upon termination for convenience.

• The total amount subject to amortization shall not exceed $225,000.00.

If termination for convenience occurs before the end of the Amortization Period, the State shall pay the unamortized balance of the Non-Recurring Implementation Costs as of the effective date of termination.

No payment shall be made under this subsection:

• For costs already recovered through payments made under this Contract;

• For lost profits, anticipated revenues, or consequential damages;

• For costs that could reasonably have been avoided or mitigated; or

• If termination is for cause.

The amounts described in this Section constitute Contractor’s sole and exclusive remedy for termination for convenience.

Transition Responsibilities. Upon termination or expiration of this Contract for any reason, Contractor must, for a period of time specified by the State (not to exceed 90 calendar days), provide all reasonable transition assistance requested by the State, to allow for the expired or terminated portion of the Contract Activities to continue without interruption or adverse effect, and to facilitate the orderly transfer of such Contract Activities to the State or its designees.

Such transition assistance may include, but is not limited to: (a) continuing to perform the Contract Activities at the established Contract rates; (b) taking all reasonable and necessary measures to transition performance of the work, including all applicable Contract Activities, , equipment, , , reports and other documentation, to the State or the State’s designee; (c (d) preparing an accurate accounting from which the State and Contractor may reconcile all outstanding accounts (e) returning all state property as set forth in Section 31, below; and (f) surrendering or destroying all State Confidential Information as set forth in Section 38.e, below (collectively, “Transition Responsibilities”). This Contract will automatically be extended through the end of the transition period.

Return of State Property Not Including Confidential Information. Upon termination or expiration of this Contract for any reason, Contractor must take all necessary and appropriate steps, or such other action as the State may direct, to preserve, maintain, protect, or return to the State all materials, data, property, and confidential information provided directly or indirectly to the Contractor by any entity, agent, vendor, or employee of the State.

Indemnification. Contractor must defend, indemnify and hold the State, its departments, divisions, agencies, offices, commissions, officers, and employees harmless, from and against claims, losses liabilities, damages, costs, attorney fees, and expenses, arising out of, resulting from (including those required to establish the right to indemnification): (a) any breach by Contractor (or any of Contractor’s employees, agents, subcontractors, or by anyone else for whose acts any of them may be liable) of any of the promises, agreements, representations, Version 2025-2 Page 9 of 18 warranties, or insurance requirements contained in this Contract; (b) any infringement, misappropriation, or other violation of any intellectual property right or other right of any third party resulting from Contractor’s performance under this Contract; (c) any bodily injury, death, or damage to real or tangible personal property caused by the negligent acts or omissions or willful misconduct of Contractor (or any of Contractor’s employees, agents, subcontractors, or by anyone else for whose acts any of them may be liable); and (d) any negligent or wrongful acts or omissions of Contractor (or any of Contractor’s employees, agents, subcontractors) in the performance of this Contract.

The State will notify Contractor in writing if indemnification is sought; however, failure to do so will not relieve Contractor, except to the extent that Contractor is materially prejudiced.

Contractor must, to the satisfaction of the State, demonstrate its financial ability to carry out these obligations.

The State is entitled to: (i) regular updates on proceeding status; (ii) participate in the defense of the proceeding; (iii) employ its own counsel; and to (iv) retain control of the defense, at its own cost and expense, if the State deems necessary. Contractor will not, without the State’s prior written consent (not to be unreasonably withheld), settle, compromise, or consent to the entry of any judgment in or otherwise seek to terminate any claim, action, or proceeding.

Any litigation activity on behalf of the State, or any of its subdivisions under this Section, must be coordinated with the Department of Attorney General. An attorney designated to represent the State may not do so until approved by the Michigan Attorney General and appointed as a Special Assistant Attorney General.

The State is constitutionally prohibited from indemnifying Contractor or any third parties.

Infringement Remedies. If, in either party’s opinion, any piece of equipment, software, commodity, or service supplied by Contractor or its subcontractors, or its operation, use or reproduction, is likely to become the subject of a copyright, patent, trademark, or trade secret infringement claim, Contractor must, at its expense: (a) procure for the State the right to continue using the equipment, software, commodity, or service, or if this option is not reasonably available to Contractor, (b) replace or modify the same so that it becomes non-infringing; or (c) accept its return by the State with appropriate credits to the State against Contractor’s charges and reimburse the State for any losses or costs incurred as a consequence of the State ceasing its use and returning it.

Limitation of Liability and Disclaimer of Damages. IN NO EVENT WILL THE STATE’S

AGGREGATE LIABILITY TO CONTRACTOR UNDER THIS CONTRACT, REGARDLESS OF THE

FORM OF ACTION, WHETHER IN CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY OR BY

STATUTE OR OTHERWISE, FOR ANY CLAIM RELATED TO OR ARISING UNDER THIS

CONTRACT, EXCEED THE LESSER OF: (A) ONE MILLION DOLLARS; OR (B) THE MAXIMUM

AMOUNT OF FEES PAYABLE UNDER THIS CONTRACT. The State is not liable for consequential, incidental, indirect, or special damages, regardless of the nature of the action.

Version 2025-2 Page 10 of 18

Disclosure of Litigation, or Other Proceeding. Contractor must notify the State within 14 calendar days of receiving notice of any litigation, investigation, arbitration, or other proceeding (collectively, “Proceeding”) involving Contractor, a subcontractor, or an officer or director of Contractor or subcontractor, that arises during the term of the Contract, including: (a) a criminal Proceeding; (b) a parole or probation Proceeding; (c) a Proceeding under the Sarbanes-Oxley Act; (d) a civil Proceeding involving: (1) a claim that might reasonably be expected to adversely affect Contractor’s viability or financial stability; or (2) a governmental or public entity’s claim or written allegation of fraud; or (3) any complaint filed in a legal or administrative proceeding alleging the Contractor or its subcontractors discriminated against its employees, subcontractors, vendors, or suppliers during the term of this Contract; or (e) a Proceeding involving any license that Contractor is required to possess in order to perform under this Contract.

Reserved.

State Data.

a. Ownership. The State’s data (“State Data,” which will be treated by Contractor as Confidential Information) includes: (a) the State’s data, user data, and any other data collected, used, processed, stored, or generated as the result of the Contract Activities; (b) all data made available to Contractor for or during the provision of the Contract Activities, including but not limited to all text, sound, video, image files, or software; and (c) personally identifiable information (“PII“) collected, used, processed, stored, or generated as the result of the Contract Activities, including, without limitation, any information that identifies an individual, such as an individual’s social security number or other government-issued identification number, date of birth, address, telephone number, biometric data, mother’s maiden name, email address, credit card information, or an individual’s name in combination with any other of the elements here listed; and, (c) protected health information (“PHI”) and Federal Tax Information (“FTI”) collected, used, processed, stored, or generated as the result of the Contract Activities, which is defined under the Health Insurance Portability and Accountability Act (HIPAA) and its related rules and regulations.

State Data is and will remain the sole and exclusive property of the State and all right, title, and interest in the same is reserved by the State.

b. Loss or Compromise of Data. In the event of any act, error or omission, negligence, misconduct, or breach on the part of Contractor that compromises or is suspected to compromise the security, confidentiality, or integrity of State Data or the physical, technical, administrative, or organizational safeguards put in place by Contractor that relate to the protection of the security, confidentiality, or integrity of State Data, Contractor must, as applicable: (a) notify the State as soon as practicable but no later than 24 hours of becoming aware of such occurrence; (b) cooperate with the State in investigating the occurrence, including making available all relevant records, logs, files, data reporting, and other materials required to comply with applicable law or as otherwise required by the State; (c) in the case of PII or PHI, at the State’s sole election, (i) with approval and assistance from the State, notify the affected individuals who comprise the PII or PHI as soon as practicable but

Version 2025-2 Page 11 of 18 no later than is required to comply with applicable law, or, in the absence of any legally required notification period, within 5 calendar days of the occurrence; or (ii) reimburse the State for any costs in notifying the affected individuals; (d) in the case of PII, provide third-party credit and identity monitoring services to each of the affected individuals who comprise the PII for the period required to comply with applicable law, or, in the absence of any legally required monitoring services, for no less than 24 months following the date of notification to such individuals; (e) perform or take any other actions required to comply with applicable law as a result of the occurrence; (f) pay for any costs associated with the occurrence, including but not limited to any costs incurred by the State in investigating and resolving the occurrence, including reasonable attorney’s fees associated with such investigation and resolution; (g) without limiting Contractor’s obligations of indemnification as further described in this Contract, indemnify, defend, and hold harmless the State for any and all claims, including reasonable attorneys’ fees, costs, and incidental expenses, which may be suffered by, accrued against, charged to, or recoverable from the State in connection with the occurrence; (h) be responsible for recreating lost State Data in the manner and on the schedule set by the State without charge to the State; and (i) provide to the State a detailed plan within 10 calendar days of the occurrence describing the measures Contractor will undertake to prevent a future occurrence. Notification to affected individuals, as described above, must comply with applicable law, be written in plain language, not be tangentially used for any solicitation purposes, and contain, at a minimum:

name and contact information of Contractor’s representative; a description of the nature of the loss; a list of the types of data involved; the known or approximate date of the loss; how such loss may affect the affected individual; what steps Contractor has taken to protect the affected individual; what steps the affected individual can take to protect himself or herself;

contact information for major credit card reporting agencies; and, information regarding the credit and identity monitoring services to be provided by Contractor. The State will have the option to review and approve any notification sent to affected individuals prior to its delivery.

Notification to any other party, including but not limited to public media outlets, must be reviewed and approved by the State in writing prior to its dissemination. The parties agree that any damages relating to a breach of this Section 37 are to be considered direct damages and not consequential damages.

c. Contractor must comply with the requirements of the Data Security Schedule, found in Schedule E.

d. Third Party Requests. Contractor will immediately notify the State upon receipt of any third-party requests which in any way might reasonably require access to State Data. Contractor will notify the State Program Managers or their designees by the fastest means available and also in writing. Contractor must provide such notification within twenty-four (24) hours from Contractor’s receipt of the request. Contractor will not respond to subpoenas, service of process, FOIA requests, and other legal requests related to the State without first notifying the State. Upon request by the State, Contractor must provide to the State, its proposed

Version 2025-2 Page 12 of 18 response to the third-party request with adequate time for the State to review, and, as it deems necessary, to revise the response, object, or take other action.

Non-Disclosure of Confidential Information. The parties acknowledge that each party may be exposed to or acquire communication or data of the other party that is confidential, privileged communication not intended to be disclosed to third parties.

a. Meaning of Confidential Information. For the purposes of this Contract, the term “Confidential Information” means all information and documentation of a party that is placed in a confidential records destruction bin. The confidential information may include, but may not be limited to, personally identifying information (PII), personal health information (PHI), criminal justice information (CJI), federal taxpayer information (FTI), and state taxpayer information (STI).

b. Obligation of Confidentiality. The parties agree to hold all Confidential Information in strict confidence and not to copy, reproduce, sell, transfer, or otherwise give or disclose such Confidential Information to third parties other than employees, agents, or subcontractors of a party who have a need to know in connection with this Contract or to use such Confidential Information for any purposes whatsoever other than the performance of this Contract. The parties agree to advise and require their respective employees, agents, and subcontractors of their obligations to keep all Confidential Information confidential.

Disclosure to a subcontractor is permissible where: (a) use of a subcontractor is authorized under this Contract; (b) the disclosure is necessary or otherwise naturally occurs in connection with work that is within the subcontractor's responsibilities; and (c) Contractor obligates the subcontractor in a written contract to maintain the State's Confidential Information in confidence. At the State's request, any employee of Contractor or any subcontractor may be required to execute a separate agreement to be bound by the provisions of this Section.

c. Cooperation to Prevent Disclosure of Confidential Information. Each party must use its best efforts to assist the other party in identifying and preventing any unauthorized use or disclosure of any Confidential Information. Without limiting the foregoing, each party must advise the other party immediately in the event either party learns or has reason to believe that any person who has had access to Confidential Information has violated or intends to violate the terms of this Contract and each party will cooperate with the other party in seeking injunctive or other equitable relief against any such person.

d. Remedies for Breach of Obligation of Confidentiality. Each party acknowledges that breach of its obligation of confidentiality may give rise to irreparable injury to the other party, which damage may be inadequately compensable in the form of monetary damages.

Accordingly, a party may seek and obtain injunctive relief against the breach or threatened breach of the foregoing undertakings, in addition to any other legal remedies which may be available, to include, in the case of the State, at the sole election of the State, the immediate termination, without liability to the State, of this Contract or any Statement of Work corresponding to the breach or threatened breach.

Version 2025-2 Page 13 of 18

e. Surrender of Confidential Information upon Termination. Upon termination of this Contract or a Statement of Work, in whole or in part, each party must, within 5 calendar days from the date of termination, return to the other party any and all Confidential Information received from the other party, or created or received by a party on behalf of the other party, which are in such party’s possession, custody, or control. Upon confirmation from the State, of receipt of all data, Contractor must permanently sanitize or destroy the State’s Confidential Information, including State Data, from all media including backups using National Security Agency (“NSA”) and/or National Institute of Standards and Technology (“NIST”) (NIST Guide for Media Sanitization 800-88) data sanitization methods or as otherwise instructed by the State. If the State determines that the return of any Confidential Information is not feasible or necessary, Contractor must destroy the Confidential Information as specified above. The Contractor must certify the destruction of Confidential Information (including State Data) in writing within 5 Business Days from the date of confirmation from the State. However, the State’s legal ability to destroy Contractor data may be restricted by its retention and disposal schedule, in which case Contractor’s Confidential Information will be destroyed after the retention period expires.

Data Privacy and Information Security.

a. Undertaking by Contractor. Without limiting Contractor’s obligation of confidentiality as further described, Contractor is responsible for establishing and maintaining a data privacy and information security program, including physical, technical, administrative, and organizational safeguards, that is designed to: (a) ensure the security and confidentiality of the State Data; (b) protect against any anticipated threats or hazards to the security or integrity of the State Data; (c) protect against unauthorized disclosure, access to, or use of the State Data; (d) ensure the proper disposal of State Data; and (e) ensure that all employees, agents, and subcontractors of Contractor, if any, comply with all of the foregoing. In no case will the safeguards of Contractor’s data privacy and information security program be less stringent than the safeguards used by the State, and Contractor must at all times comply with all applicable State IT policies and standards, which are available to Contractor upon request.

b. Audit by Contractor. No less than annually, Contractor must conduct a comprehensive independent third-party audit of its data privacy and information security program and provide such audit findings to the State.

c. Right of Audit by the State. Without limiting any other audit rights of the State, the State has the right to review Contractor’s data privacy and information security program prior to the commencement of Contract Activities and from time to time during the term of this Contract. During the providing of the Contract Activities, on an ongoing basis from time to time and without notice, the State, at its own expense, is entitled to perform, or to have performed, an on-site audit of Contractor’s data privacy and information security program.

In lieu of an on-site audit, upon request by the State, Contractor agrees to complete, within 45 calendar days of receipt, an audit questionnaire provided by the State regarding Contractor’s data privacy and information security program.

Version 2025-2 Page 14 of 18

d. Audit Findings. Contractor must implement any required safeguards as identified by the State or by any audit of Contractor’s data privacy and information security program.

e. State’s Right to Termination for Deficiencies. The State reserves the right, at its sole election, to immediately terminate this Contract or a Statement of Work without limitation and without liability if the State determines that Contractor fails or has failed to meet its obligations under this Section.

Records Maintenance, Inspection, Examination, and Audit. Pursuant to MCL 18.1470, the State or its designee may audit Contractor to verify compliance with this Contract. Contractor must retain and provide to the State or its designee and the auditor general upon request, all records related to the Contract through the term of the Contract and for 4 years after the latter of termination, expiration, or final payment under this Contract or any extension (“Audit Period”).

If an audit, litigation, or other action involving the records is initiated before the end of the Audit Period, Contractor must retain the records until all issues are resolved.

Within 10 calendar days of providing notice, the State and its authorized representatives or designees have the right to enter and inspect Contractor's premises or any other places where Contract Activities are being performed, and examine, copy, and audit all records related to this Contract. Contractor must cooperate and provide reasonable assistance. If financial errors are revealed, the amount in error must be reflected as a credit or debit on subsequent invoices until the amount is paid or refunded. Any remaining balance at the end of the Contract must be paid or refunded within 45 calendar days.

This Section applies to Contractor, any parent, affiliate, or subsidiary organization of Contractor, and any subcontractor that performs Contract Activities in connection with this Contract.

Representations and Warranties. Contractor represents and warrants: (a) Contractor is the owner or licensee of any Contract Activities that it licenses, sells, or develops and Contractor has the rights necessary to convey title, ownership rights, or licensed use; (b) all Contract Activities are delivered free from any security interest, lien, or encumbrance and will continue in that respect; (c) the Contract Activities will not infringe the patent, trademark, copyright, trade secret, or other proprietary rights of any third party; (d) Contractor must assign or otherwise transfer to the State or its designee any manufacturer's warranty for the Contract Activities; (e) the Contract Activities are merchantable and fit for the specific purposes identified in the Contract; (f) the Contract signatory has the authority to enter into this Contract; (g) all information furnished by Contractor in connection with the Contract fairly and accurately represents Contractor's business, properties, finances, and operations as of the dates covered by the information, and Contractor will inform the State of any material adverse changes;(h) all information furnished and representations made in connection with the award of this Contract is true, accurate, and complete, and contains no false statements or omits any fact that would make the information misleading; and that (i) Contractor is neither currently engaged in nor will engage in the boycott of a person based in or doing business with a strategic partner as described in 22 USC 8601 to 8606; (j) that all Contract Activities, including Software, as provided by Contractor do not and will not at any time during the Term contain any Harmful Code or any

Version 2025-2 Page 15 of 18 third party or open source components unless approved in advance by the State; and (k) that Contractor will not, and will not permit, any advertising through any Hosted Services. A breach of this Section is considered a material breach of this Contract, which entitles the State to terminate this Contract under Section 28, Termination for Cause.

a. Definitions.

(1) “Harmful Code” means any software, hardware or other technologies, devices or means, the purpose or effect of which is to: (a) permit unauthorized access to, or to destroy, disrupt, disable, encrypt, modify, copy, or otherwise harm or impede in any manner, any (i) computer, software, firmware, data, hardware, system or network, or (ii) any application or function of any of the foregoing or the integrity, use or operation of any data processed thereby; or (b) prevent the State from accessing or using the Contract Activities as intended by this Contract, and includes any virus, bug, trojan horse, worm, backdoor or other malicious computer code and any time bomb or drop dead device.

Conflicts and Ethics. Contractor will uphold high ethical standards and is prohibited from: (a) holding or acquiring an interest that would conflict with this Contract; (b) doing anything that creates an appearance of impropriety with respect to the award or performance of the Contract;

(c) attempting to influence or appearing to influence any State employee by the direct or indirect offer of anything of value; or (d) paying or agreeing to pay any person, other than employees and consultants working for Contractor, any consideration contingent upon the award of the Contract. Contractor must immediately notify the State of any violation or potential violation of these standards. This Section applies to Contractor, any parent, affiliate, or subsidiary organization of Contractor, and any subcontractor that performs Contract Activities in connection with this Contract.

Compliance with Laws. Contractor must comply with all federal, state and local laws, rules and regulations.

Prevailing Wage Act Statutory Provision. Contractor must comply with prevailing wage requirements, to the extent applicable to this…