59168.pdf

City Of Chicago Solicitation #59168

BRANDON JOHNSON SHARLA ROBERTS

MAYOR CHIEF PROCUREMENT OFFICER

Specification Number: 1335997 Type of Funding:

Title: Spec 1335997 - VALET OPERATIONS – TAX AND DATA COLLECTION SOLUTIONS

Request for Qualification Solicitation #59168 (RFI)

Specification Number:1335997

Required for use by: DEPARTMENT OF FINANCE

Bid/Proposal Submittal Date and Time: 03:00 PM Central Time, 27-FEB-2026

Deadline for Questions: 04:00 PM Central Time, 23-JAN-2026 Buyer: STEWARD, TIERRA Email Address: tierra.steward@cityofchicago.org Phone Number: 312-744-6562 Pre-Solicitation Conference Date and Time: 11:00 AM Central Time, 13-JAN-2026 Pre-Solicitation Conference Location: MICROSOFT TEAMS Site Visit Date & Time: N/A Site Visit Location: N/A

Please submit your response to:

http://www.cityofchicago.org/eProcurement iSupplier vendor portal registration is required.

Allow 3 business days to complete registration.

Specification Number: 1335997 Page 2 Type of Funding:

Title: Spec 1335997 - VALET OPERATIONS – TAX AND DATA COLLECTION SOLUTIONS

Table of Contents

1 Header Information

1.1 General Information

1.2 Terms

1.3 Requirements

1.4 Attachments

1.5 Response Rules

2 Price Schedule

2.1 Line Information

2.2 Line Details

2.2.1 Line 1

Specification Number: 1335997 Page 3 Type of Funding:

Title: Spec 1335997 - VALET OPERATIONS – TAX AND DATA COLLECTION SOLUTIONS

1 Header Information

1.1 General Information

Title Spec 1335997 - VALET OPERATIONS – TAX AND DATA

COLLECTION SOLUTIONS

Preview Date 05-JAN-2026 10:05:45 Open Date 05-JAN-2026 10:05:45

Close Date 03:00 PM Central Time, 27-FEB-2026

Award Date Not Specified

Time Zone Central Time Buyer STEWARD, TIERRA Quote Style Sealed Email tierra.

steward@cityofchicago.org Event Request for

Qualification Outcome Blanket Purchase Agreement

1.2 Terms

Effective Start Date Not Specified Effective End Date Not Specified

Ship-To Address 027- FIN DEPT

121 N. LA SALLE ST.

ROOM 700

Chicago, IL 60602 United States

Bill-To Address 027- FIN DEPT

121 N. LA SALLE ST.

ROOM 700

Chicago, IL 60602 United States

Payment Terms IMMEDIATE Carrier FOB Freight Terms

Total Agreement Amount (USD)

Not Specified Minimum Release Amount (USD)

Not Specified

1.3 Requirements

<B>REQUIRED CONTENT OF SUBMITTAL

/PROPOSAL (Please attach documents)</B>

COVER LETTER INFORMATION

Circle one from the response values below:

YES

NO

EXECUTIVE SUMMARY

Circle one from the response values below:

YES

NO

REQUESTED INFORMATIION: Respondent must respond to items listed in Section IV, Scope of Requested Information, B Interrogatories (Attachment E)

Circle one from the response values below:

YES

NO

COMPANY PROFILE INFORMATION

Circle one from the response values below:

YES

NO

COMPANY REFERENCES INFORMATION

Circle one from the response values below:

YES

NO

Specification Number: 1335997 Page 4 Type of Funding:

Title: Spec 1335997 - VALET OPERATIONS – TAX AND DATA COLLECTION SOLUTIONS

<B>KEY RFP/RFQ PARAMETERS</B>

PRE-SUBMITTAL CONFERENCE: January 13, 2026, at 11:00 a.m., Central Time via Microsoft Teams Meeting. All Attendees must pre-register to participate. Interested Attendees must email Tierra Steward at Tierra.Steward@cityofchicago.org Email Subject: Pre-Informational Conference for Valet Operations – Tax and Data Collections Solutions

Type No Response Required

1.4 Attachments

Name Data Type Description ATTACHMENT 01: RFI File

1.5 Response Rules

Solicitation is restricted to invited suppliers Suppliers are allowed to view other suppliers' contract terms, notes and attachments Suppliers are allowed to respond to selected lines X Suppliers are allowed to provide multiple responses Buyer may close the solicitation before the Close Date Buyer may manually extend the solicitation while it is open

Specification Number: 1335997 Page 5 Type of Funding:

Title: Spec 1335997 - VALET OPERATIONS – TAX AND DATA COLLECTION SOLUTIONS

2 Price Schedule

2.1 Line Information

Display Rank As No indicator displayed

Ranking Price Only Cost Factors None

Line Item, Rev / Job

Target Quantity

Unit Unit Price Amount

1 Valet Operations - Tax and Data Collection Solutions:

Request for Information ("RFI")

1 Event

2.2 Line Details

2.2.1 Line 1 Valet Operations - Tax and Data Collection Solutions: Request for Information ("RFI") Category 96258.13 Start Price (USD) Not Specified

Shopping Category Not Specified Target Price (USD) Not Specified Minimum Release

Amount (USD) Not Specified

Estimated Total Amount (USD)

Not Specified

REQUEST FOR INFORMATION (RFI)

VALET OPERATIONS – TAX AND DATA COLLECTION SOLUTIONS

SPECIFICATION NO. 1335997, RFQ 59168

Required for use by:

CITY OF CHICAGO

Department of Finance

Issued by:

CITY OF CHICAGO

Department of Procurement Services

ELECTRONIC RESPONSE INCLUDING ANY COMPANY LITERATURE OR DATA MUST BE SUBMITTED

All responses shall be submitted to:

Sharla D. Roberts, Chief Procurement Officer

Attention: Tierra Steward

Department of Procurement Services http://www.cityofchicago.org/eProcurement

Responses must be received no later than 3:00 PM. Central Time, on February 27, 2026. The responses must be submitted electronically through the City’s iSupplier eProcurement system for the project, Request for Information (RFI) for Valet Operations – Tax and Data Collection Solutions, Specification No.

1335997

BRANDON JOHNSON SHARLA D. ROBERTS

MAYOR CHIEF PROCUREMENT OFFICER

Tierra Steward, Senior Procurement Specialist, (312) 744-6562

RFI for Valet Operations – Tax and Data Collection Solutions Specification No. 1335997, RFQ 59168

REQUEST FOR INFORMATION

SUBJECT: Valet Operations – Tax and Data Collection Solutions

INQUIRIES: All inquiries or questions must be directed to Tierra Steward, Senior Procurement Specialist, at the City of Chicago Department of Procurement Services, (312) 744-6562, by eProcurement online discussion or by email at tierra.steward@cityofchicago.org.

Questions must be received no later than 4:00 PM, Central Time on January 23, 2026. If a determination is made that a clarification or change to the RFI document is required, a written addendum will be issued through the eProcurement system by the Department of Procurement Services to all RFI document holders.

Respondents are responsible for obtaining all RFI materials.

Deadline and Procedures for Submitting Responses

Responses must be received by the City of Chicago no later than 3:00 p.m. Central Time on February

27, 2026.

Paper responses will not be accepted. Responses must be submitted to the following address:

iSupplier - http://www.cityofchicago.org/eprocurement

Responses must be submitted electronically to the Department of Procurement Services no later than

February 27, 2026. Respondent must submit all required information by scanning and uploading as attachment(s) to the electronic RFI submission in iSupplier.

"iSupplier" refers to the City's eProcurement computer system for electronic bidding and providing

Contractors with access to contract, ordering and payment information for their City contracts.

iSupplier vendor portal registration is required. Allow three (3) business days to complete registration.

Submit your response including any company literature or data. Submittals shall be labeled: “RFI for Valet

Operations - Tax and Data Collection Solutions” Specification No.1335997. Please return this sheet with completed information below as a part of your submittal documents.

Responding to this RFI is not a pre-requisite for responding to any subsequent solicitations relating to this project.

Response submitted by:

Company Name Authorized Officer Signature in Ink

Address Title

City/State/Zip Code Telephone Number

Date E-mail Address mailto:tierra.steward@cityofchicago.org.

http://www.cityofchicago.org/eprocurement

TABLE OF CONTENTS

I. GENERAL INVITATION

A. PURPOSE OF THE REQUEST OF INFORMATION

B. BACKGROUND

C. INTERNET ACCESS TO THIS RFI

II. OBJECTIVES OF RFI

III. GENERAL TERMS FOR RFI

A. DISCLAIMER

B. CONFIDENTIALITY

C. INCURRED COSTS

D. TECHNOLOGY DEMONSTRATION (IF APPLICABLE)

E. PROHIBITION ON CERTAIN CONTRIBUTIONS – MAYORAL EXECUTIVE ORDER NO. 2011-4

F. FALSE STATEMENTS

IV. SCOPE OF REQUESTED INFORMATION

A. GENERAL SCOPE

B. INTERROGATORIES

C. SCHEDULE

V. SUBMITTAL REQUIREMENTS: REQUIRED INFORMATION

A. FORMAT OF SUBMITTALS

B. REQUIRED CONTENT OF SUBMITTAL

I. COVER PAGE

II. EXECUTIVE SUMMARY

III. REQUESTED INFORMATION

IV. AGREEMENT OF TERMS OF DISCUSSION

V. COMPANY PROFILE AND REFERENCES

ATTACHMENT A

Agreement on Terms of Discussion

ATTACHMENT B

Company Profile Information

ATTACHMENT C

Company Profile Information

1. POLICY

2. DEFINITIONS

3. INFORMATION SECURITY

ATTACHMENT D

Data Protections Requirements for Contractors, Vendors and Third Parties

ATTACHMENT E

Interrogatories

APPENDIX 1 - EPROCUREMENT

ePROCUREMENT

I. GENERAL INVITATION

A. PURPOSE OF THE REQUEST OF INFORMATION

The City of Chicago (“City”), acting through its Department of Finance and the Department of Business Affairs and Consumer Protection, seeks responses to this Request for Information (“RFI”) from vendors in the information technology industry who have demonstrated experience and expertise with data collection and payment processing and remittance. If you are interested in participating, you are invited to respond to this RFI by the due date indicated.

B. BACKGROUND

The City currently has approximately 100 registered valet operators, operating at more than 400 locations across the City of Chicago. In 2024, the City collected more than $3.6 million in parking tax from valet operations. However, based on historical audit findings, this collection should have been substantially more. During the City's routine audits and tax compliance investigations, there have been discoveries that surfaced previously unforeseen gaps that can be mitigated by enhanced data tracking tools, which can increase the effectiveness of internal controls and provide tools to identify compliance issues. With a 23.25% tax rate on valet parking, each unreported transaction costs the City a significant amount of tax revenue. Furthermore, the valet parking fee includes a tax paid by the consumer with the understanding that it will be used to fund essential City services and operations. When a collected tax is not remitted to the taxing jurisdiction, it is a breach of public trust. Therefore, the City is seeking ways to narrow and close this gap.

C. INTERNET ACCESS TO THIS RFI

All Respondents are responsible for retrieving all RFI materials from eProcurement. The City accepts no responsibility for the timely receipt of materials or for alerting Respondents on posting to the DPS website information related to this RFI in eProcurement.

Respondent must read Appendix I eProcurement for more details regarding electronic access to RFI abstract and documents to be submitted electronically and uploaded as attachments to your response.

II. OBJECTIVES OF RFI

This RFI seeks new and innovative technological solutions to improve tax and data collection from licensed valet parking companies that operate in the City of Chicago to increase tax compliance, provide consumer and operator protection, and transparency in operations and transactions that give rise to the tax liability.

Currently, valet operators are required to pay their tax liability and file a tax return for a given month by the fifteenth day of the following month. The City does not currently offer a technological solution for automated payment, therefore licensed valet operators must remit taxes manually, as well as provide operational data when requested by the City.

Enforcement activity involving the valet parking industry generally yields significant findings for several reasons, including a lack of sophisticated data tracking, inadequate internal controls, and intentional under-reporting. Additionally, due to a lack of real time data tracking, consumer and operator protections such as ensuring valet operators are licensed, the ability to track cars in valet parking service including at the parked location, as well as overall security and safety, are weakened. A robust technological solution will enable licensed valet operators to electronically track and inventory vehicles in their possession, provide consumers with proof of services, as well as collect valet payments and remit taxes in real time.

The City believes this is an opportune time to review best practices in other jurisdictions and to seek innovative solutions that will address the aforementioned challenges. Such ideas will enable the City to increase tax receipts, increase compliance with operational requirements, generate robust data to facilitate the audit process, as well as increase consumer protections through a transparent and consumer focused data-based process. Proposed solutions must protect consumers and operators from fraud and loss and increase safety and security measures.

III. GENERAL TERMS FOR RFI

A. DISCLAIMER

Responses to this RFI become the exclusive property of the City. All documents submitted in response to this RFI may be regarded as public records and may be subject to disclosure. This RFI is issued solely for information and planning purposes and does not constitute a solicitation. No material submitted in response to this RFI will be returned. Respondents are solely responsible for all expenses associated with responding to this RFI.

B. CONFIDENTIALITY

All submissions are subject to the Illinois Freedom of Information Act. To the extent that the Respondent desires to submit proprietary information to the City, the City represents that it will use all reasonable efforts to claim available exemptions under state Freedom of Information Act (FOIA) law and will notify Respondent if a FOIA request is received in connection with that proprietary information. All materials that the respondent believes are proprietary MUST be labeled "Proprietary, privileged and confidential." The City, of course, cannot guarantee that its efforts to claim available exemptions will be successful and the City may be required to disclose the Respondent's information.

C. INCURRED COSTS

The City of Chicago will not be liable in any way for any costs incurred by Respondents in replying to this RFI, including, but not limited, to costs associated with preparing the response, participating in any site visits, demonstrations, conferences, or oral presentations.

D. TECHNOLOGY DEMONSTRATION (IF APPLICABLE)

If a firm has a technology solution that can be demonstrated on the Internet, please provide the URL with the response. In addition, the City reserves the right to request a presentation or demonstration of the services.

E. PROHIBITION ON CERTAIN CONTRIBUTIONS – MAYORAL EXECUTIVE ORDER NO.

2011-4

No Contractor or any person or entity who directly or indirectly has an ownership or beneficial interest in Contractor of more than 7.5% ("Owners"), spouses and domestic partners of such Owners, Contractor’s Subcontractors, any person or entity who directly or indirectly has an ownership or beneficial interest in any Subcontractor of more than 7.5% ("Sub-owners") and spouses and domestic partners of such Sub-owners (Contractor and all the other preceding classes of persons and entities are together, the "Identified Parties"), shall make a contribution of any amount to the Mayor of the City of Chicago (the "Mayor") or to her political fundraising committee during (i) the bid or other solicitation process for this Contract or Other Contract, including while this Contract or Other Contract is executory, (ii) the term of this Contract or any Other Contract between City and Contractor, and/or (iii) any period in which an extension of this Contract or Other Contract with the City is being sought or negotiated.

Contractor represents and warrants that since the date of public advertisement of the specification, request for qualifications, request for proposals or request for information (or any combination of those requests) or, if not competitively procured, from the date the City approached the Contractor or the date the Contractor approached the City, as applicable, regarding the formulation of this Contract, no Identified Parties have made a contribution of any amount to the Mayor or to her political fundraising committee.

Contractor shall not: (a) coerce, compel or intimidate its employees to make a contribution of any amount to the Mayor or to the Mayor’s political fundraising committee; (b) reimburse its employees for a contribution of any amount made to the Mayor or to the Mayor’s political fundraising committee; or (c) bundle or solicit others to bundle contributions to the Mayor or to her political fundraising committee.

The Identified Parties must not engage in any conduct whatsoever designed to intentionally violate this provision or Mayoral Executive Order No. 2011-4 or to entice, direct or solicit others to intentionally violate this provision or Mayoral Executive Order No. 2011-4.

Violation of, non-compliance with, misrepresentation with respect to, or breach of any covenant or warranty under this provision or violation of Mayoral Executive Order No. 2011-4 constitutes a breach and default under this Contract, and under any Other Contract for which no opportunity to cure will be granted. Such breach and default entitles the City to all remedies (including without limitation termination for default) under this Contract, under Other Contract, at law and in equity. This provision amends any Other Contract and supersedes any inconsistent provision contained therein.

If Contractor violates this provision or Mayoral Executive Order No. 2011-4 prior to award of the Contract resulting from this specification, the Chief Procurement Officer may reject Contractor’s bid.

For purposes of this provision:

"Other Contract" means any agreement entered into between the Contractor and the City that is (i) formed under the authority of MCC Ch. 2-92; (ii) for the purchase, sale or lease of real or personal property; or (iii) for materials, supplies, equipment or services which are approved and/or authorized by the City Council.

"Contribution" means a "political contribution" as defined in MCC Ch. 2-156, as amended.

"Political fundraising committee" means a "political fundraising committee" as defined in MCC Ch. 2-156, as amended.

F. FALSE STATEMENTS

(a) 1-21-010 False Statements

Any person who knowingly makes a false statement of material fact to the city in violation of any statute, ordinance or regulation, or who knowingly falsifies any statement of material fact made in connection with an application, report, affidavit, oath, or attestation, including a statement of material fact made in connection with a bid, proposal, contract or economic disclosure statement or affidavit, is liable to the city for a civil penalty of not less than $500.00 and not more than

$1,000.00, plus up to three times the amount of damages which the city sustains because of the person’s violation of this section. A person who violates this section shall also be liable for the city’s litigation and collection costs and attorney’s fees.

The penalties imposed by this section shall be in addition to any other penalty provided for in the municipal code. (Added Coun. J. 12-15-04, p. 39915, § 1)

(b) 1-21-020 Aiding and Abetting.

Any person who aids, abets, incites, compels or coerces the doing of any act prohibited by this chapter shall be liable to the city for the same penalties for the violation. (Added Coun. J. 12 -15- 04, p. 39915, § 1)

(c) 1-21-030 Enforcement.

In addition to any other means authorized by law, the corporation counsel may enforce this chapter by instituting an action with the department of administrative hearings. (Added Coun. J.

12-15-04, p. 39915, § 1)

IV. SCOPE OF REQUESTED INFORMATION

This RFI is for planning purposes only. It is neither a solicitation notice nor a Request for Proposal.

Responses to the RFI are not offers and cannot be accepted by the City to form a binding contract. No standard City terms and conditions or contractual language is contained herein, nor it is required in your response. Furthermore, the City has no obligation to acquire any products or services and can neither directly nor indirectly pay for the information solicited, or compensate for any costs associated with the submission of a response to the RFI or the City’s use of such information. No vendor will be selected for contract negotiations or award from this RFI.

This RFI shall not limit any rights of the City, and the City reserves all of its rights including, but not limited to, its right to elect not to procure the goods and/or services that are the subject of this RFI and its right to procure them from a vendor that has not responded to this RFI.

A. GENERAL SCOPE

The description of the technological solution for which the City seeks information is intended to be general in nature, and is neither a complete, nor limiting, description of the solution. The City is open to responses using a variety of technological and operational models, and strategies to achieve the proposed solution.

The project must be supported by a sustainable business model that can be easily scaled and that demonstrates a measurable investment return. The City is open to a variety of compensation methodologies, with preference for those that require little to no upfront investment by the City. However, the City will consider making capital or other investments, if warranted.

The City is seeking information on solutions that are able to provide, including but not limited to, the following:

1. Real time reporting.

2. Real time remittance of tax payments from valet operators.

3. Valet operator license information and vehicle location tracking, including data such as valet employees, date/time of vehicle drop-off and pick-up, locations and number of vehicles in the possession of the licensed valet operator at any given time, payment remitted, individual and total tax assessed, and date/time and duration of vehicle possession in valet.

4. Ability for the customer and valet operator to exchange information in a safe and secure manner.

5. Ability to accept multiple forms of electronic payment.

6. Backup solution for processing payments and remitting applicable taxes when there is an application failure.

7. Process for identifying noncompliant operators.

8. Marketing and public information strategy.

9. Ability to track GPS location against active licensed valet locations.

Some additional options for Respondent submittal to address:

1. License plate recognition technology as part of a ticketless solution, if feasible.

2. Link to the City's parking ticket database to determine who was in possession of a vehicle when tickets are issued (consumer protection).

3. Management and compliance structures that support implementation and compliance.

4. Integration with the City's complaint database to manage complaint outcomes and offer tracking of repeat offenders.

Any other potential uses for the proposed technology as applicable to the needs of this RFI.

B. INTERROGATORIES

In addition to addressing the scope above, please also provide responses and information concerning the following in Attachment C:

1. Description of proposed solution and how it meets the scope above.

2. Provide examples of proposed/similar systems in other municipalities, including information on successes, challenges, and any measurable outcomes.

3. Describe how the consumer, operator, and the City will interface with the proposed solution.

4. Describe the structure of the system and how it manages compliance with applicable regulations1.

5. Describe how the proposed organization will ensure valet operators are utilizing the proposed solution.

6. How will the system ensure data security and privacy?

7. What is the system of data integration and how would reporting be structured (what, when frequency, etc.)?

8. How will tax revenue be remitted to the City?

9. Describe potential compensation structures.

10. Describe your firm's experience in developing and implementing valet parking operations and data collection solutions similar to the one requested by the City in this RFI.

11. Is your firm able to provide this system/solution alone or are you required to provide this

1 Also see Municipal Code of Chicago (“MCC”) 4-236-025; 9-100-150; 4-232-080(d); 4-232-070; 4-232-080;

and 4-232-070.

system/solution in conjunction with a partner firm(s)?

C. SCHEDULE

The following activities and corresponding dates are tentative and subject to change via a written Addendum issued by the Department of Procurement Services in eProcurement for all RFI document holders.

Key Activity

Target Date

City Issues RFI January 2, 2026

RFI Questions Due

January 23, 2026

Submittals Due February 27, 2026

V. SUBMITTAL REQUIREMENTS: REQUIRED INFORMATION

Each Submittal must contain all of the following documents and must conform to the following requirements.

A. FORMAT OF SUBMITTALS

The Proposal shall be submitted as an electronic Proposal. The electronic Proposal shall be one file that is a word-searchable pdf file.

B. REQUIRED CONTENT OF SUBMITTAL

Proposal content must be clear, concise and well organized. Respondents are strongly discouraged from including marketing or promotional materials not related specifically to the focus of this RFI. Respondents are advised to adhere to the submittal requirements of the RFI.

At a minimum, the Submittal must include the following items:

I. COVER PAGE

The Submittal must begin with a cover page bearing the name, address and company number of the Respondent and the name and number of this RFI. The City reserves the right to request clarifications or any additional information from any Respondents at any time during this RFI process.

II. EXECUTIVE SUMMARY

Respondents must provide an executive summary which explains its understanding of the City’s intent and objectives and how their response would achieve those objectives. The summary is to include the Respondent’s proposed solution for Valet Operations, as described in Section IV, A. General Scope, above.

III. REQUESTED INFORMATION

Respondents must respond to items listed in Section IV, Scope of Requested Information, B.

Interrogatories.

IV. AGREEMENT OF TERMS OF DISCUSSION

Provide a fully executed copy of Attachment A entitled “Agreement on Terms of Discussion” (hereinafter referred to as “Agreement”). The Agreement shall be executed by an authorized representative(s) of the Respondent’s organization. Failure to include the fully executed copy of the Agreement will result in the entire response being returned to the Respondent without review.

V. COMPANY PROFILE AND REFERENCES

Provide completed company profile with background information and three (3) client references per Attachment B.

ATTACHMENT A

Agreement on Terms of Discussion

Any information given to the City in any correspondence, discussion, meeting, or other communication between our organization and the City before, with, or after the submission of our response to the Request for Information and Interest (RFI), either orally or in writing, will not be, or deemed to have been, given in confidence, although the City will use reasonable efforts not to disclose such information to persons who are not employees of, or consultants retained by the City except as required by law, including the Freedom of

Information Act. Disclosure or use will be made without obligation or compensation and without liability by the City of any kind whatsoever.

The foregoing applies to any information, whether or not given at the invitation of the City. Any statement which is inconsistent with the foregoing provisions of this paragraph whether made as part of, or in connection with, any information received from you or otherwise made at any time in any fashion, and whether made orally or in writing, shall be deemed null and void and of no force or effect. The City’s receipt or discussion or use of any information submitted in response to this RFI including information submitted during discussions after said submittal (including ideas, drawings or other materials communicated or exhibited) is not to impose any obligations whatsoever on the City or entitle Responders to any compensation. No patent or other intellectual property rights are intended to be transferred to the City hereby.

RESPONDENT

Name of Firm:

Signature:

Print Name:

Title:

Email

Address:

Telephone:

Date:

ATTACHMENT B

Company Profile Information

Name of Firm: ________________________________________________________________ Headquarters Address: _________________________________________________________ City, State, Zip Code: __________________________________________________________ Web Site Address: _____________________________________________________________ Business Organization:

( ) Sole Proprietor ( ) Partnership, ( ) Limited Liability Company; ( ) Corporation State of Incorporation: __________________________________________________________ Number of Years in Business: ____________________________________________________ Total Number of Employees: ____________________________________________________ Total Annual Revenues separated by last 3 full fiscal years: ____________________________ Number of Municipal Clients: _____________________________________________________

REFERENCES (List 3 Clients for similar services or solution):

Client #1 Name: ______________________________________________________________________ Address: ____________________________________________________________________ Contact Person & Telephone #: __________________________________________________ E-Mail Address: _______________________________________________________________ Product & Date In-Service: ______________________________________________________

Client #2 Name: ______________________________________________________________________ Address: ____________________________________________________________________ Contact Person & Telephone #: __________________________________________________ E-Mail Address: _______________________________________________________________ Product & Date In-Service:_______________________________________________________

Client #3 Name: _______________________________________________________________________ Address: _____________________________________________________________________ Contact Person & Telephone #:____________________________________________________ E-Mail Address: ________________________________________________________________ Product & Date In-Service: _______________________________________________________

Other Major Products and/or Services:

Describe your firm’s experience in developing and implementing Valet Operations – Tax and Data Collection Solutions requested by the City:

ATTACHMENT C

Company Profile Information

1. POLICY

It is the policy of the City of Chicago that any entity that receives or encounters Protected Information must comply with the City Data Policy as set forth in this Article. Therefore, Contractor agrees to comply with the Policy, and agrees to inform and obtain the agreement to comply with this Policy from subcontractors of any tier, including, without limitation, entities that store Protected Information, or host applications that process Protected Information. For purposes of this Article, "Contractor" includes any subcontractor, entity that stores Protected Information, host application or any other entity that receives or encounters Protected Information.

2. DEFINITIONS

For purposes of this Article, the following terms shall mean:

"Breach" means the acquisition, access, use, or disclosure of Protected Information that compromises the security or privacy of the Protected Information.

"Protected Information" means all data provided by City to Contractor or encountered by Contractor in the performance of the services to the City, including, without limitation, all data sent to Contractor by City and/or stored by Contractor on its servers. Protected Information includes, but is not limited to, employment records, medical and health records, personal financial records (or other personally identifiable information), research data, and classified government information. To the extent there is any uncertainty as to whether any data constitutes Protected Information, the data in question shall be treated as Protected Information.

3. INFORMATION SECURITY

Contractor agrees to the following:

General Notwithstanding any other obligation of Contractor under this Contract, Contractor agrees that it will not lose, alter, or delete, either intentionally or unintentionally, any Protected Information, and that it is responsible for the safe-keeping of all such information, except to the extent that the City directs the Contractor in writing to do so.

Access to Data In addition to the records to be stored / maintained by Contractor, all records that are possessed by Contractor in its service to the City of Chicago to perform a governmental function are public records of the City of Chicago pursuant to the Illinois Freedom of Information Act (FOIA), unless the records are exempt under the Act. FOIA requires that the City produce records in a very short period of time. If the Contractor receives a request from the City to produce records, the Contractor shall do so within 72 hours of the notice.

Minimum Standard for Data at Rest and Data in Motion Contractor must, at a minimum, comply, in its treatment of Protected Information, with National Institute of Standards and Technology (NIST) Special Publication 800-53 Moderate Level Control. Notwithstanding this requirement, Contractor acknowledges that it must fully comply with each additional obligation contained in this policy. If data is protected health information or electronic protected health information, as defined in the Health Insurance Portability and Accountability Act and Health Information Technology for Economic and Clinical Health Act (HIPAA/HITECH) and regulations implementing these Acts (see 45 CFR Parts 160 and 164), it must be secured in accordance with “Guidance Specifying the Technologies and Methodologies that Render Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals,” available on the United States Department of Health and Human Services (HHS) website (http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/index.html), or at Volume 74 of the Federal Register, beginning at page 42742. That guidance from the HHS states that valid encryption processes for protected health information data at rest (e.g., protected health information resting on a server), must be consistent with the NIST Special Publication 800-111, Guide for Storage Encryption Technologies for End User Devices. Valid encryption processes for protected health information data in motion (e.g., transmitted through a network) are those which comply with NIST Special Publications 800-52, Guidelines for the Selection and Use of Transport Layer Security Implementation; 800-77, Guide to IPsec VPNs; or 800-113, Guide to SSL VPNs, or others which are Federal Information Processing Standards (FIPS) 140-2 validated.

Where Data is to be Stored

All data must be stored only on computer systems located in the continental United States.

Requirement to Maintain Security Program Contractor acknowledges that the City has implemented an information security program to protect the City’s information assets, which Program is available on the City website at http://www.cityofchicago.org/city/en/depts/doit/supp_info/initiatives_-_informationsecurity.html (“City Program”).

Contractor shall be responsible for establishing and maintaining an information security program that is designed to: (i) ensure the security and confidentiality of Protected Information; (ii) protect against any anticipated threats or hazards to the security or integrity of Protected Information; (iii) protect against unauthorized access to or use of Protected Information; (iv) ensure the proper disposal of Protected Information; and, (v) ensure that all subcontractors of Contractor, if any, comply with all of the foregoing.

Undertaking by Contractor Without limiting Contractor’s obligation of confidentiality as further described herein, in no case shall the safeguards of Contractor’s information security program be less stringent than the information security safeguards used by the City Program.

Right of Audit by the City of Chicago The City of Chicago shall have the right to review Contractor’s information security program prior to the commencement of Services and from time to time during the term of this Contract. During the performance of the Services, from time to time and without notice, the City of Chicago, at its own expense, shall be entitled to perform, or to have performed, an on-site audit of Contractor’s information security program. In lieu of an on-site audit, upon request by the City of Chicago, Contractor agrees to complete, within forty-five (45 days) of receipt, an audit questionnaire provided by the City of Chicago or the City of Chicago’s designee regarding Contractor’s information security program.

Audit by Contractor No less than annually, Contractor shall conduct an independent third-party audit of its information security program and provide such audit findings to the City of Chicago, all at the Contractor’s sole expense.

Audit Findings Contractor shall implement at its sole expense any remedial actions as identified by the City as a result of the audit.

Demonstrate Compliance – PCI No less than annually, as defined by the City of Chicago and where applicable, the Contractor agrees to demonstrate compliance with PCI DSS (Payment Card Industry Data Security Standard). Upon City’s request, Contractor must be prepared to demonstrate compliance of any system or component used to process, store, or transmit cardholder data that is operated by the Contractor as part of its service. Similarly, upon City’s request, Contractor must demonstrate the compliance of any third party it has sub-contracted as part of the service offering. As evidence of compliance, the Contractor shall provide upon request a current attestation of compliance signed by a PCI QSA (Qualified Security Assessor).

Demonstrate Compliance – HIPAA / HITECH If the Protected Information includes protected health information or electronic protected health information covered under HIPAA/HITECH, Contractor must execute, and be governed by, the provisions in its contract with the City regarding HIPAA/HITECH, the regulations implementing those Acts, and the Business Associate Agreement in its contract with the City. As specified in Section C, "Minimum Standard for Data at Rest and Data in Motion" above, protected health information must be secured in accordance with the "Guidance Specifying the Technologies and Methodologies that Render Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals."

Data Confidentiality Contractor shall implement appropriate measures designed to ensure the confidentiality and security of Protected Information, protect against any anticipated hazards or threats to the integrity or security of such information, protect against unauthorized access or disclosure of information, and prevent any other action that could result in substantial harm to the City of Chicago or an individual identified with the data or information in Contractor’s custody.

Limitation of Access

Contractor will not knowingly permit any Contractor personnel to have access to any City of Chicago facility or any records or data of the City of Chicago if the person has been convicted of a crime in connection with (i) a dishonest act, breach of trust, or money laundering, or (ii) a felony. Contractor must, to the extent permitted by law, conduct a check of public records in all of the employee’s states of residence and employment for at least the last five years in order to verity the above. Contractor shall assure that all contracts with subcontractors impose these obligations on the subcontractors and shall monitor the subcontractors’ compliance with such obligations.

Data Re-Use Contractor agrees that any and all data exchanged shall be used expressly and solely for the purposes enumerated in the Contract. Data shall not be distributed, repurposed or shared across other applications, environments, or business units of Contractor. As required by Federal law, Contractor further agrees that no City of Chicago data of any kind shall be revealed, transmitted, exchanged or otherwise passed to other Contractors or interested parties except on a case-by-case basis as specifically agreed to in writing by an officer of the City of Chicago with designated data, security, or signature authority.

Safekeeping and Security Contractor will be responsible for safekeeping all keys, access codes, passwords, combinations, access cards, personal identification numbers and similar security codes and identifiers issued to Contractor’s employees, agents or subcontractors. Contractor agrees to require its employees to promptly report a lost or stolen access device or information to their primary business contact and to the City of Chicago Information Security Office.

Mandatory Disclosure of Protected Information If Contractor is compelled by law or regulation to disclose any Protected Information, the Contractor will provide to the City of Chicago with prompt written notice so that the City of Chicago may seek an appropriate protective order or other remedy. If a remedy acceptable to the City of Chicago is not obtained by the date that the Contractor must comply with the request, the Contractor will furnish only that portion of the Protected Information that it is legally required to furnish, and the Contractor shall require any recipient of the Protected Information to exercise commercially reasonable efforts to keep the Protected Information confidential.

Data Breach Contractor agrees to comply with all laws and regulations relating to data breach, including without limitation, the Illinois Personal Information Protection Act and other applicable Illinois breach disclosure laws and regulations. Data breaches of protected health information and electronic protected health information shall be governed by the provisions regarding HIPAA/HITECH, and the regulations implementing those Acts, in the Contractor’s contract with the City, specifically the Business Associate Agreement in such contract. Contractor will immediately notify the City if security of any Protected Information has been breached, and will provide information as to that breach in such detail as requested by the City. Contractor will, if requested by the City, notify any affected individuals of such breach at the sole cost of the Contractor.

Data Sanitization and Safe Disposal All physical and electronic records must be retained per federal, state and local laws and regulations, including the Local Records Act. Where disposal is approved, the Contractor agrees that prior to disposal or reuse of all magnetic media (e.g. hard disk, floppy disk, removable media, etc.) which may have contained City of Chicago data shall be submitted to a data sanitization process which meets or exceeds Department of Defense 5220.28-M 3-pass specifications.

Certification of the completion of data sanitization shall be provided to the City of Chicago within 10 days of completion.

Acceptance of Certification of Data Sanitization by the Information Security Office of the City of Chicago is required prior to media reuse or disposal. All other materials which contain City of Chicago data shall be physically destroyed and shredded in accordance to NIST Special Publication 800-88, Guidelines for Media Sanitization, specifications.

End of Contract Data Handling The Contractor agrees that upon termination of this Contract it shall return all data to the City of Chicago in a useable electronic form, and erase, destroy, and render unreadable all data in its entirety in accordance to the prior stated Data Sanitization and Safe Disposal provisions. Data must be rendered in a manner that prevents its physical reconstruction through the use of commonly available file restoration utilities. Certification in writing that these actions have been completed must be provided within 30 days of the termination of this Contract or within 7 days of a request of an agent of the City of Chicago, whichever shall come first.

ATTACHMENT D

Data Protections Requirements for Contractors, Vendors and Third Parties

“Breach” means the acquisition, access, use, or disclosure of Protected Information that compromises the security or privacy of the Protected Information.

"Contractor" means an entity that receives or encounters Protected Information. Contractor includes, without limitation, entities that store Protected Information, or host applications that process Protected Information. The provisions of this Data Policy includes not only the entity that is a signatory to this Policy but all subcontractors, of whatever tier, of that entity; the signatory must inform and obtain the agreement of such subcontractors to the terms of this Data Policy.

“Protected Information” means all data provided by City to Contractor or encountered by Contractor in the performance of the services to the City, including, without limitation, all data sent to Contractor by City and/or stored by Contractor on its servers. Protected Information includes, but is not limited to, employment records, medical and health records, personal financial records (or other personally identifiable information), research data, and classified government information. To the extent there is any uncertainty as to whether any data constitutes Protected Information, the data in question shall be treated as Protected Information.

1. Information Security. Contractor agrees to the following:

1.1. General. Notwithstanding any other obligation of Contractor under this policy, Contractor agrees that it will not lose, alter, or delete, either intentionally or unintentionally, any Protected Information, and that it is responsible for the safe-keeping of all such information, except to the extent that the City directs the Contractor in writing to do so.

1.2. Access to Data. In addition to the records to be stored / maintained by Contractor, all records that are possessed by Contractor in its service to the City of Chicago to perform a governmental function are public records of the City of Chicago pursuant to the Illinois Freedom of Information Act (FOIA), unless the records are exempt under the Act. FOIA requires that the City produce records in a very short period of time. If the Contractor receives a request from the City to produce records, the Contractor shall do so within 72 hours of the notice.

1.3. Minimum Standard for Data at Rest and Data in Motion. Contractor must, at a minimum, comply, in its treatment of

Protected Information, with National Institute of Standards and Technology (NIST) Special Publication 800-53 Moderate Level Control. Notwithstanding this requirement, Contractor acknowledges that it must fully comply with each additional obligation contained in this policy. If data is protected health information or electronic protected health information, as defined in the Health Insurance Portability and Accountability Act and Health Information Technology for Economic and Clinical Health Act (HIPAA/HITECH) and regulations implementing these Acts (see 45 CFR Parts 160 and 164), it must be secured in accordance with “Guidance Specifying the Technologies and Methodologies that Render Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals,” available on the United States Department of Health and Human Services (HHS) website http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/index.html, or at Volume 74 of the Federal Register, beginning at page 42742. That guidance from the HHS states that valid encryption processes for protected health information data at rest (e.g., protected health information resting on a server), must be consistent with the NIST Special Publication 800-111, Guide for Storage Encryption Technologies for End User Devices. Valid encryption processes for protected health information data in motion (e.g., transmitted through a network) are those which comply with NIST Special Publications 800-52, Guidelines for the Selection and Use of Transport Layer Security Implementation; 800-77, Guide to IPsec VPNs; or 800-113, Guide to SSL VPNs, or others which are Federal Information Processing Standards (FIPS) 140-2 validated.

1.4. Where Data is to be Stored. All data must be stored only on computer systems located in the continental United States.

1.5. Requirement to Maintain Security Program. Contractor acknowledges that the City has implemented an information security program to protect the City’s information assets, which Program is available on the City website at http://www.cityofchicago.org/city/en/depts/doit/supp_info/is-and-it-policies.html (“City Program”). Contractor shall be responsible for establishing and maintaining an information security program that is designed to: (i) ensure the security and confidentiality of Protected Information; (ii) protect against any anticipated threats or hazards to the security or integrity of Protected Information; (iii) protect against unauthorized access to or use of Protected Information; (iv) ensure the proper disposal of Protected Information; and, (v) ensure that all subcontractors of Contractor, if any, comply with all of the foregoing.

1.6. Undertaking by Contractor. Without limiting Contractor’s obligation of confidentiality as further described herein, in no case shall the safeguards of Contractor’s information security program be less stringent than the information security safeguards used by the City Program.

1.7. Right of Audit by the City of Chicago. The City of Chicago shall have the right to review Contractor’s information security program prior to the commencement of Services and from time to time during the term of this Agreement.

During the performance of the Services, from time to time and without notice, the City of Chicago, at its own expense, shall be entitled to perform, or to have…