Appendices A-C.pdf

STANDARD CLAUSES FOR NYS CONTRACTS APPENDIX A

Page 2 June 2023

TABLE OF CONTENTS

Page

1. Executory Clause 3

2. Non-Assignment Clause 3

3. Comptroller’s Approval 3

4. Workers’ Compensation Benefits 3

5. Non-Discrimination Requirements 3

6. Wage and Hours Provisions 3-4

7. Non-Collusive Bidding Certification 4

8. International Boycott Prohibition 4

9. Set-Off Rights 4

10. Records 4

11. Identifying Information and Privacy Notification 4

12. Equal Employment Opportunities For Minorities and Women 5

13. Conflicting Terms 5

14. Governing Law 5

15. Late Payment 5

16. No Arbitration 5

17. Service of Process 5

18. Prohibition on Purchase of Tropical Hardwoods 5-6

19. MacBride Fair Employment Principles 6

20. Omnibus Procurement Act of 1992 6

21. Reciprocity and Sanctions Provisions 6

22. Compliance with Breach Notification and Data Security Laws 6

23. Compliance with Consultant Disclosure Law 6

24. Procurement Lobbying 7

25. Certification of Registration to Collect Sales and Compensating Use Tax by Certain 7

State Contractors, Affiliates and Subcontractors

26. Iran Divestment Act 7

27. Admissibility of Contract 7

Page 3 June 2023

STANDARD CLAUSES FOR NYS CONTRACTS

The parties to the attached contract, license, lease, amendment or other agreement of any kind (hereinafter, “the contract” or “this contract”) agree to be bound by the following clauses which are hereby made a part of the contract (the word “Contractor” herein refers to any party other than the State, whether a contractor, licenser, licensee, lessor, lessee or any other party):

1. EXECUTORY CLAUSE. In accordance with Section 41 of the State Finance Law, the State shall have no liability under this contract to the Contractor or to anyone else beyond funds appropriated and available for this contract.

2. NON-ASSIGNMENT CLAUSE. In accordance with Section 138 of the State Finance Law, this contract may not be assigned by the Contractor or its right, title or interest therein assigned, transferred, conveyed, sublet or otherwise disposed of without the State’s previous written consent, and attempts to do so are null and void. Notwithstanding the foregoing, such prior written consent of an assignment of a contract let pursuant to Article XI of the State Finance Law may be waived at the discretion of the contracting agency and with the concurrence of the State Comptroller where the original contract was subject to the State Comptroller’s approval, where the assignment is due to a reorganization, merger or consolidation of the Contractor’s business entity or enterprise. The State retains its right to approve an assignment and to require that any Contractor demonstrate its responsibility to do business with the State. The Contractor may, however, assign its right to receive payments without the State’s prior written consent unless this contract concerns Certificates of Participation pursuant to Article 5-A of the State Finance Law.

3. COMPTROLLER’S APPROVAL. In accordance with Section 112 of the State Finance Law, if this contract exceeds $50,000 (or $75,000 for State University of New York or City University of New York contracts for goods, services, construction and printing, and $150,000 for State University Health Care Facilities) or if this is an amendment for any amount to a contract which, as so amended, exceeds said statutory amount, or if, by this contract, the State agrees to give something other than money when the value or reasonably estimated value of such consideration exceeds $25,000, it shall not be valid, effective or binding upon the State until it has been approved by the State Comptroller and filed in his office.

Comptroller’s approval of contracts let by the Office of General Services, either for itself or its customer agencies by the Office of General Services Business Services Center, is required when such contracts exceed $85,000. Comptroller’s approval of contracts established as centralized contracts through the Office of General Services is required when such contracts exceed $125,000, and when a purchase order or other procurement transaction issued under such centralized contract exceeds $200,000.

4. WORKERS’ COMPENSATION BENEFITS. In accordance with Section 142 of the State Finance Law, this contract shall be void and of no force and effect unless the Contractor shall provide and maintain coverage during the life of this contract for the benefit of such employees as are required to be covered by the provisions of the Workers’ Compensation Law.

5. NON-DISCRIMINATION REQUIREMENTS. To the extent required by Article 15 of the Executive Law (also known as the Human Rights Law) and all other State and Federal statutory and constitutional non-discrimination provisions, the Contractor will not discriminate against any employee or applicant for employment, nor subject any individual to harassment, because of age, race, creed, color, national origin, citizenship or immigration status, sexual orientation, gender identity or expression, military status, sex, disability, predisposing genetic characteristics, familial status, marital status, or domestic violence victim status or because the individual has opposed any practices forbidden under the Human Rights Law or has filed a complaint, testified, or assisted in any proceeding under the Human Rights Law.

Furthermore, in accordance with Section 220-e of the Labor Law, if this is a contract for the construction, alteration or repair of any public building or public work or for the manufacture, sale or distribution of materials, equipment or supplies, and to the extent that this contract shall be performed within the State of New York, Contractor agrees that neither it nor its subcontractors shall, by reason of race, creed, color, disability, sex, or national origin: (a) discriminate in hiring against any New York State citizen who is qualified and available to perform the work; or (b) discriminate against or intimidate any employee hired for the performance of work under this contract.

If this is a building service contract as defined in Section 230 of the Labor Law, then, in accordance with Section 239 thereof, Contractor agrees that neither it nor its subcontractors shall by reason of race, creed, color, national origin, age, sex or disability: (a) discriminate in hiring against any New York State citizen who is qualified and available to perform the work;

or (b) discriminate against or intimidate any employee hired for the performance of work under this contract. Contractor is subject to fines of $50.00 per person per day for any violation of Section 220-e or Section 239 as well as possible termination of this contract and forfeiture of all moneys due hereunder for a second or subsequent violation.

6. WAGE AND HOURS PROVISIONS. If this is a public work contract covered by Article 8 of the Labor Law or a building service contract covered by Article 9 thereof, neither Contractor’s employees nor the employees of its subcontractors may be required or permitted to work more than the number of hours or days stated in said statutes, except as otherwise provided in the Labor Law and as set forth in prevailing wage and supplement schedules issued by the State Labor Department. Furthermore, Contractor and its subcontractors must pay at least the prevailing wage rate and pay or provide the prevailing supplements, including the premium rates for overtime pay, as determined by the State Labor Department in

Page 4 June 2023 accordance with the Labor Law. Additionally, effective April 28, 2008, if this is a public work contract covered by Article 8 of the Labor Law, the Contractor understands and agrees that the filing of payrolls in a manner consistent with Subdivision 3-a of Section 220 of the Labor Law shall be a condition precedent to payment by the State of any State approved sums due and owing for work done upon the project.

7. NON-COLLUSIVE BIDDING CERTIFICATION. In accordance with Section 139-d of the State Finance Law, if this contract was awarded based upon the submission of bids, Contractor affirms, under penalty of perjury, that its bid was arrived at independently and without collusion aimed at restricting competition. Contractor further affirms that, at the time Contractor submitted its bid, an authorized and responsible person executed and delivered to the State a non-collusive bidding certification on Contractor’s behalf.

8. INTERNATIONAL BOYCOTT PROHIBITION. In accordance with Section 220-f of the Labor Law and Section 139-h of the State Finance Law, if this contract exceeds $5,000, the Contractor agrees, as a material condition of the contract, that neither the Contractor nor any substantially owned or affiliated person, firm, partnership or corporation has participated, is participating, or shall participate in an international boycott in violation of the federal Export Administration Act of 1979 (50 USC App. Sections 2401 et seq.) or regulations thereunder. If such Contractor, or any of the aforesaid affiliates of Contractor, is convicted or is otherwise found to have violated said laws or regulations upon the final determination of the United States Commerce Department or any other appropriate agency of the United States subsequent to the contract’s execution, such contract, amendment or modification thereto shall be rendered forfeit and void. The Contractor shall so notify the State Comptroller within five (5) business days of such conviction, determination or disposition of appeal (2 NYCRR § 105.4).

9. SET-OFF RIGHTS. The State shall have all of its common law, equitable and statutory rights of set-off. These rights shall include, but not be limited to, the State’s option to withhold for the purposes of set-off any moneys due to the Contractor under this contract up to any amounts due and owing to the State with regard to this contract, any other contract with any State department or agency, including any contract for a term commencing prior to the term of this contract, plus any amounts due and owing to the State for any other reason including, without limitation, tax delinquencies, fee delinquencies or monetary penalties relative thereto. The State shall exercise its set-off rights in accordance with normal State practices including, in cases of set-off pursuant to an audit, the finalization of such audit by the State agency, its representatives, or the State Comptroller.

10. RECORDS. The Contractor shall establish and maintain complete and accurate books, records, documents, accounts and other evidence directly pertinent to performance under this contract (hereinafter, collectively, the “Records”). The Records must be kept for the balance of the calendar year in which they were made and for six (6) additional years thereafter. The State Comptroller, the Attorney General and any other person or entity authorized to conduct an examination, as well as the agency or agencies involved in this contract, shall have access to the Records during normal business hours at an office of the Contractor within the State of New York or, if no such office is available, at a mutually agreeable and reasonable venue within the State, for the term specified above for the purposes of inspection, auditing and copying. The State shall take reasonable steps to protect from public disclosure any of the Records which are exempt from disclosure under Section 87 of the Public Officers Law (the “Statute”) provided that: (i) the Contractor shall timely inform an appropriate State official, in writing, that said records should not be disclosed; and (ii) said records shall be sufficiently identified; and (iii) designation of said records as exempt under the Statute is reasonable. Nothing contained herein shall diminish, or in any way adversely affect, the State’s right to discovery in any pending or future litigation.

11. IDENTIFYING INFORMATION AND PRIVACY

NOTIFICATION. (a) Identification Number(s). Every invoice or New York State Claim for Payment submitted to a New York State agency by a payee, for payment for the sale of goods or services or for transactions (e.g., leases, easements, licenses, etc.) related to real or personal property must include the payee’s identification number. The number is any or all of the following: (i) the payee’s Federal employer identification number, (ii) the payee’s Federal social security number, and/or

(iii) the payee’s Vendor Identification Number assigned by the Statewide Financial System. Failure to include such number or numbers may delay payment. Where the payee does not have such number or numbers, the payee, on its invoice or Claim for Payment, must give the reason or reasons why the payee does not have such number or numbers.

(b) Privacy Notification. (1) The authority to request the above personal information from a seller of goods or services or a lessor of real or personal property, and the authority to maintain such information, is found in Section 5 of the State Tax Law.

Disclosure of this information by the seller or lessor to the State is mandatory. The principal purpose for which the information is collected is to enable the State to identify individuals, businesses and others who have been delinquent in filing tax returns or may have understated their tax liabilities and to generally identify persons affected by the taxes administered by the Commissioner of Taxation and Finance. The information will be used for tax administration purposes and for any other purpose authorized by law. (2) The personal information is requested by the purchasing unit of the agency contracting to purchase the goods or services or lease the real or personal property covered by this contract or lease. The information is maintained in the Statewide Financial System by the Vendor Management Unit within the Bureau of State Expenditures, Office of the State Comptroller, 110 State Street, Albany, New York 12236.

Page 5 June 2023

12. EQUAL EMPLOYMENT OPPORTUNITIES FOR

MINORITIES AND WOMEN. In accordance with Section 312 of the Executive Law and 5 NYCRR Part 143, if this contract is: (i) a written agreement or purchase order instrument, providing for a total expenditure in excess of $25,000.00, whereby a contracting agency is committed to expend or does expend funds in return for labor, services, supplies, equipment, materials or any combination of the foregoing, to be performed for, or rendered or furnished to the contracting agency; or (ii) a written agreement in excess of $100,000.00 whereby a contracting agency is committed to expend or does expend funds for the acquisition, construction, demolition, replacement, major repair or renovation of real property and improvements thereon; or (iii) a written agreement in excess of $100,000.00 whereby the owner of a State assisted housing project is committed to expend or does expend funds for the acquisition, construction, demolition, replacement, major repair or renovation of real property and improvements thereon for such project, then the following shall apply and by signing this agreement the Contractor certifies and affirms that it is Contractor’s equal employment opportunity policy that:

(a) The Contractor will not discriminate against employees or applicants for employment because of race, creed, color, national origin, sex, age, disability or marital status, shall make and document its conscientious and active efforts to employ and utilize minority group members and women in its work force on State contracts and will undertake or continue existing programs of affirmative action to ensure that minority group members and women are afforded equal employment opportunities without discrimination. Affirmative action shall mean recruitment, employment, job assignment, promotion, upgradings, demotion, transfer, layoff, or termination and rates of pay or other forms of compensation;

(b) at the request of the contracting agency, the Contractor shall request each employment agency, labor union, or authorized representative of workers with which it has a collective bargaining or other agreement or understanding, to furnish a written statement that such employment agency, labor union or representative will not discriminate on the basis of race, creed, color, national origin, sex, age, disability or marital status and that such union or representative will affirmatively cooperate in the implementation of the Contractor’s obligations herein; and

(c) the Contractor shall state, in all solicitations or advertisements for employees, that, in the performance of the State contract, all qualified applicants will be afforded equal employment opportunities without discrimination because of race, creed, color, national origin, sex, age, disability or marital status.

Contractor will include the provisions of “(a), (b) and (c)” above, in every subcontract over $25,000.00 for the construction, demolition, replacement, major repair, renovation, planning or design of real property and improvements thereon (the “Work”) except where the Work is for the beneficial use of the Contractor. Section 312 does not apply to: (i) work, goods or services unrelated to this contract;

or (ii) employment outside New York State. The State shall consider compliance by a contractor or subcontractor with the requirements of any federal law concerning equal employment opportunity which effectuates the purpose of this clause. The contracting agency shall determine whether the imposition of the requirements of the provisions hereof duplicate or conflict with any such federal law and if such duplication or conflict exists, the contracting agency shall waive the applicability of Section 312 to the extent of such duplication or conflict.

Contractor will comply with all duly promulgated and lawful rules and regulations of the Department of Economic Development’s Division of Minority and Women’s Business Development pertaining hereto.

13. CONFLICTING TERMS. In the event of a conflict between the terms of the contract (including any and all attachments thereto and amendments thereof) and the terms of this Appendix A, the terms of this Appendix A shall control.

14. GOVERNING LAW. This contract shall be governed by the laws of the State of New York except where the Federal supremacy clause requires otherwise.

15. LATE PAYMENT. Timeliness of payment and any interest to be paid to Contractor for late payment shall be governed by Article 11-A of the State Finance Law to the extent required by law.

16. NO ARBITRATION. Disputes involving this contract, including the breach or alleged breach thereof, may not be submitted to binding arbitration (except where statutorily authorized), but must, instead, be heard in a court of competent jurisdiction of the State of New York.

17. SERVICE OF PROCESS. In addition to the methods of service allowed by the State Civil Practice Law & Rules (“CPLR”), Contractor hereby consents to service of process upon it by registered or certified mail, return receipt requested.

Service hereunder shall be complete upon Contractor’s actual receipt of process or upon the State’s receipt of the return thereof by the United States Postal Service as refused or undeliverable. Contractor must promptly notify the State, in writing, of each and every change of address to which service of process can be made. Service by the State to the last known address shall be sufficient. Contractor will have thirty (30) calendar days after service hereunder is complete in which to respond.

18. PROHIBITION ON PURCHASE OF TROPICAL

HARDWOODS. The Contractor certifies and warrants that all wood products to be used under this contract award will be in accordance with, but not limited to, the specifications and provisions of Section 165 of the State Finance Law, (Use of Tropical Hardwoods) which prohibits purchase and use of tropical hardwoods, unless specifically exempted, by the State or any governmental agency or political subdivision or public benefit corporation. Qualification for an exemption under this

Page 6 June 2023 law will be the responsibility of the contractor to establish to meet with the approval of the State.

In addition, when any portion of this contract involving the use of woods, whether supply or installation, is to be performed by any subcontractor, the prime Contractor will indicate and certify in the submitted bid proposal that the subcontractor has been informed and is in compliance with specifications and provisions regarding use of tropical hardwoods as detailed in § 165 State Finance Law. Any such use must meet with the approval of the State; otherwise, the bid may not be considered responsive. Under bidder certifications, proof of qualification for exemption will be the responsibility of the Contractor to meet with the approval of the State.

19. MACBRIDE FAIR EMPLOYMENT PRINCIPLES. In accordance with the MacBride Fair Employment Principles (Chapter 807 of the Laws of 1992), the Contractor hereby stipulates that the Contractor either (a) has no business operations in Northern Ireland, or (b) shall take lawful steps in good faith to conduct any business operations in Northern Ireland in accordance with the MacBride Fair Employment Principles (as described in Section 165 of the New York State Finance Law), and shall permit independent monitoring of compliance with such principles.

20. OMNIBUS PROCUREMENT ACT OF 1992. It is the policy of New York State to maximize opportunities for the participation of New York State business enterprises, including minority- and women-owned business enterprises as bidders, subcontractors and suppliers on its procurement contracts.

Information on the availability of New York State subcontractors and suppliers is available from:

NYS Department of Economic Development Division for Small Business and Technology Development 625 Broadway Albany, New York 12245 Telephone: 518-292-5100

A directory of certified minority- and women-owned business enterprises is available from:

NYS Department of Economic Development Division of Minority and Women’s Business Development 633 Third Avenue 33rd Floor New York, NY 10017 646-846-7364 email: mwbebusinessdev@esd.ny.gov https://ny.newnycontracts.com/FrontEnd/searchcertifieddir ectory.asp

The Omnibus Procurement Act of 1992 (Chapter 844 of the Laws of 1992, codified in State Finance Law § 139-i and Public Authorities Law § 2879(3)(n)–(p)) requires that by signing this bid proposal or contract, as applicable, Contractors certify that whenever the total bid amount is greater than $1 million:

(a) The Contractor has made reasonable efforts to encourage the participation of New York State Business Enterprises as suppliers and subcontractors, including certified minority- and women-owned business enterprises, on this project, and has retained the documentation of these efforts to be provided upon request to the State;

(b) The Contractor has complied with the Federal Equal Opportunity Act of 1972 (P.L. 92-261), as amended;

(c) The Contractor agrees to make reasonable efforts to provide notification to New York State residents of employment opportunities on this project through listing any such positions with the Job Service Division of the New York State Department of Labor, or providing such notification in such manner as is consistent with existing collective bargaining contracts or agreements. The Contractor agrees to document these efforts and to provide said documentation to the State upon request; and

(d) The Contractor acknowledges notice that the State may seek to obtain offset credits from foreign countries as a result of this contract and agrees to cooperate with the State in these efforts.

21. RECIPROCITY AND SANCTIONS PROVISIONS.

Bidders are hereby notified that if their principal place of business is located in a country, nation, province, state or political subdivision that penalizes New York State vendors, and if the goods or services they offer will be substantially produced or performed outside New York State, the Omnibus Procurement Act 1994 and 2000 amendments (Chapter 684 and Chapter 383, respectively, codified in State Finance Law § 165(6) and Public Authorities Law § 2879(5)) require that they be denied contracts which they would otherwise obtain.

NOTE: As of May 2023, the list of discriminatory jurisdictions subject to this provision includes the states of South Carolina, Alaska, West Virginia, Wyoming, Louisiana and Hawaii.

22. COMPLIANCE WITH BREACH NOTIFICATION

AND DATA SECURITY LAWS. Contractor shall comply with the provisions of the New York State Information Security Breach and Notification Act (General Business Law §§ 899-aa and 899-bb and State Technology Law § 208).

23. COMPLIANCE WITH CONSULTANT

DISCLOSURE LAW. If this is a contract for consulting services, defined for purposes of this requirement to include analysis, evaluation, research, training, data processing, computer programming, engineering, environmental, health, and mental health services, accounting, auditing, paralegal, legal or similar services, then, in accordance with Section 163 (4)(g) of the State Finance Law (as amended by Chapter 10 of the Laws of 2006), the Contractor shall timely, accurately and properly comply with the requirement to submit an annual employment report for the contract to the agency that awarded the contract, the Department of Civil Service and the State Comptroller.

mailto:mwbebusinessdev@esd.ny.gov https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fny.newnycontracts.com%2FFrontEnd%2Fsearchcertifieddirectory.asp&data=05%7C01%7CBradley.Allen%40ogs.ny.gov%7C07e93ddbe7724c0737a408db5793a42e%7Cf46cb8ea79004d108ceb80e8c1c81ee7%7C0%7C0%7C638200063847647689%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=1QagyzmFXhFPSsIsYt57VrXQpxA4Tw6kD6PHIqJx7wM%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fny.newnycontracts.com%2FFrontEnd%2Fsearchcertifieddirectory.asp&data=05%7C01%7CBradley.Allen%40ogs.ny.gov%7C07e93ddbe7724c0737a408db5793a42e%7Cf46cb8ea79004d108ceb80e8c1c81ee7%7C0%7C0%7C638200063847647689%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=1QagyzmFXhFPSsIsYt57VrXQpxA4Tw6kD6PHIqJx7wM%3D&reserved=0

Page 7 June 2023

24. PROCUREMENT LOBBYING. To the extent this agreement is a “procurement contract” as defined by State Finance Law §§ 139-j and 139-k, by signing this agreement the contractor certifies and affirms that all disclosures made in accordance with State Finance Law §§ 139-j and 139-k are complete, true and accurate. In the event such certification is found to be intentionally false or intentionally incomplete, the State may terminate the agreement by providing written notification to the Contractor in accordance with the terms of the agreement.

25. CERTIFICATION OF REGISTRATION TO

COLLECT SALES AND COMPENSATING USE TAX BY

CERTAIN STATE CONTRACTORS, AFFILIATES AND

SUBCONTRACTORS.

To the extent this agreement is a contract as defined by Tax Law § 5-a, if the contractor fails to make the certification required by Tax Law § 5-a or if during the term of the contract, the Department of Taxation and Finance or the covered agency, as defined by Tax Law § 5-a, discovers that the certification, made under penalty of perjury, is false, then such failure to file or false certification shall be a material breach of this contract and this contract may be terminated, by providing written notification to the Contractor in accordance with the terms of the agreement, if the covered agency determines that such action is in the best interest of the State.

26. IRAN DIVESTMENT ACT. By entering into this Agreement, Contractor certifies in accordance with State Finance Law § 165-a that it is not on the “Entities Determined to be Non-Responsive Bidders/Offerers pursuant to the New York State Iran Divestment Act of 2012” (“Prohibited Entities List”) posted at: https://ogs.ny.gov/iran-divestment-act-2012

The state agency reserves the right to reject any bid, request for assignment, renewal or extension for an entity that appears on the Prohibited Entities List prior to the award, assignment, renewal or extension of a contract, and to pursue a responsibility review with respect to any entity that is awarded a contract and appears on the Prohibited Entities list after contract award.

27. ADMISSIBILITY OF REPRODUCTION OF

CONTRACT. Notwithstanding the best evidence rule or any other legal principle or rule of evidence to the contrary, the Contractor acknowledges and agrees that it waives any and all objections to the admissibility into evidence at any court proceeding or to the use at any examination before trial of an electronic reproduction of this contract, in the form approved by the State Comptroller, if such approval was required, regardless of whether the original of said contract is in existence.

Contractor further certifies that it will not utilize on this Contract any subcontractor that is identified on the Prohibited Entities List. Contractor agrees that should it seek to renew or extend this Contract, it must provide the same certification at the time the Contract is renewed or extended. Contractor also agrees that any proposed Assignee of this Contract will be required to certify that it is not on the Prohibited Entities List before the contract assignment will be approved by the State.

During the term of the Contract, should the state agency receive information that a person (as defined in State Finance Law § 165-a) is in violation of the above-referenced certifications, the state agency will review such information and offer the person an opportunity to respond. If the person fails to demonstrate that it has ceased its engagement in the investment activity which is in violation of the Act within 90 days after the determination of such violation, then the state agency shall take such action as may be appropriate and provided for by law, rule, or contract, including, but not limited to, imposing sanctions, seeking compliance, recovering damages, or declaring the Contractor in default.

https://ogs.ny.gov/iran-divestment-act-2012

Appendix B

Information Security

(a) Protected Information, Generally. CONTRACTOR acknowledges that its performance of Services under this Agreement may involve access to confidential information of CUNY or Users including, but not limited to, personally identifiable information, student records, protected health information, or individual financial information (collectively, “Protected or Private Information”) that is subject to state or federal law/rules restricting the use and disclosure of such information, including, but not limited to; the federal Gramm Leach Bliley Act (15 U.S.C. §§ 6801(b) and 6805(b)(2)); the federal Family Educational Rights and Privacy Act (20 U.S.C. § 1232g); and the privacy and information security aspects of the Administrative Simplification provisions of the federal Health Insurance Portability and Accountability Act (45 CFR Part 160 and Subparts A, C, and E of Part 164); the Payment Card Industry Data Security Standards.

CONTRACTOR agrees to comply with all applicable federal and state laws restricting the access, use and disclosure of Protected Information. CONTRACTOR agrees to include all of the terms and conditions contained in all subcontractor or agency contracts providing services under this Agreement.

(b) Prohibition on Unathorized Use or Disclosure. CONTRACTOR agrees to hold CUNY’s and its Users’ Protected or Private Information, and any information derived from such information, in strictest confidence. CONTRACTOR shall not access, use or disclose Protected or Private Information except as permitted or required by the Agreement or as otherwise authorized in writing by CUNY, or applicable laws. If required by a court of competent jurisdiction or an administrative body to disclose Protected of Private Information, CONTRACTOR shall notify CUNY in writing immediately upon receiving notice of such requirement and prior to any such disclosure, to give CUNY an opportunity to oppose or otherwise respond to such disclosure (unless prohibited by law from doing so). Any transmission, transportation or storage of Protected or Private Information outside the United States is prohibited except on prior written authorization by CUNY.

(c) Data Storage and Access. All CUNY Data transferred to CONTRACTOR must be stored, housed, process, backed-up, archived and otherwise retained on systems physically located in the continental United States. This requirement extends to any subcontractors of data storage. CONTRACTOR shall ensure that all CUNY Data is stored in a controlled access environment to ensure data security and integrity. All facilities proposed for use in storing CUNY Data must have adequate security systems in place to protect against unauthorized access to the facilities and the data stored therein. Access to the facilities must be restricted through an access control system that requires positive identification of authorized individuals as well as maintains a log of all access (including, without limitation, time, date and identity). CONTRACTOR shall have in place a formal procedure for granting computer system access to the data and to track access by its own employees.

More specifically, all CUNY Data shall remain in the Continental United States (“CONUS”). Any CUNY Data stored, or acted upon, must be located solely in Data Centers in CONUS. Services which directly or indirectly access CUNY Data may only be performed from locations within CONUS. All CUNY Data in transit must be handled in accordance with FIPS-140-2 or TLS1 or TLS2 (or successor).

Support Services. All helpdesk, online and support services which access any CUNY Data must be performed within CONUS. At no time will any Follow the Sun support be allowed to access CUNY Data directly, or indirectly, from outside CONUS.

Infrastructure Support Services. Infrastructure support services that do not directly or indirectly access CUNY Data may be provided in a Follow the Sun format, if expressly outlined within the Authorized User Agreement.

(d) Data Exchange. Except as otherwise set forth in the Agreement, CONTRACTOR shall make arrangements to receive or exchange all CUNY Data via CUNY’s systems of record. CONTRACTOR shall use reliable means of electronically transferring data between CUNY of its offices or facilities. Such means must ensure the confidentiality and integrity of data while in transit.

(e) Data Protection. CONTRACTOR shall use appropriate means to preserve and protect CUNY Data, including, without limitation, use of stable storage media, regular data back-ups and archiving, password protection of volumes, and data encryption.

(f) Data Return and Destruction. Upon CUNY’s written request, at any time during the term of the Agreement and upon termination or expiration of the Agreement, CONTRACTOR shall promptly return to CUNY, in the format and on the media requested by CUNY, all or part of the CUNY Data. Upon termination of the Agreement, and following the return of the CUNY Data as described in the preceding sentence (if applicable), CONTRACTOR shall employ the technical measures necessary to assure the secure, irreversible, and complete erasure or destruction of all data storage formats to eliminate any and all data collected by CONTRACTOR or provided by CUNY or its Users unless explicit provisions for the retention of some data sets have been stipulated in the Agreement. Upon CUNY’s request, CONTRACTOR shall provide written certification of the completion of the foregoing.

(g) Breaches of Protected Information.

Definition. For purposes of this Section, the term, “Breach,” has the meaning given to it under the applicable New York State or federal law.

Reporting of Breach. Immediately upon discovery of a confirmed or suspected Breach, CONTRACTOR shall report both orally and in writing to CUNY. In no event shall the report be made more than twenty four hours after CONTRACTOR knows or reasonably suspects a Breach has or may have occurred. In the event of a suspected Breach, CONTRACTOR shall keep CUNY informed regularly of the progress of its investigation until the uncertainty is resolved. CONTRACTOR’s report shall identify:

(i) The nature of the unauthorized access, use or disclosure,

(ii) The Protected or Private Information accessed, used or disclosed,

(iii) The person(s) who accessed, used and disclosed and/or received Protected or Private Information (if known),

(iv) What CONTRACTOR has done or will do to mitigate any deleterious effect of the unauthorized access, use or disclosure, and

(v) What corrective action CONTRACTOR has taken or will take to prevent future unauthorized access, use or disclosure.

CONTRACTOR shall provide such other information, including a written report, as reasonably requested by CUNY.

(h) Coordination of Breach Response Activities. In the event of a Breach, CONTRACTOR shall:

(i) Immediately preserve any potential forensic evidence relating to the Breach;

(ii) Promptly (within 2 business days) designate a contact person to whom CUNY will direct inquiries, and who will communicate its responses to CUNY’s inquiries;

(iii) As rapidly as circumstances permit, apply appropriate resources to remedy the Breach condition, investigate, document, restore CUNY’s service(s) as directed by CUNY, and undertake appropriate response activities;

(iv) Provide status reports to CUNY on Breach response activities, either on a daily basis or a frequency approved by CUNY;

(v) Coordinate all media, law enforcement, or other Breach notifications with CUNY in advance of such notification(s), unless expressly prohibited by law;

(vi) Make all reasonable efforts to assist and cooperate with CUNY in its Breach response efforts; and

(vii) Ensure that knowledgeable CONTRACTOR staff are available on short notice, if needed, to participate in CUNY-initiated meetings and/or conference calls regarding the Breach.

(i) Costs Arising from Breach. Notwithstanding anything to the contrary in this Agreement, in the event of a Breach by CONTRACTOR or its staff, it shall promptly reimburse all costs to CUNY arising from such Breach, including but not limited to costs of notification of individuals, establishing and operating call center(s), credit monitoring and/or identity restoration services, time of CUNY personnel responding to Breach, civil or criminal penalties levied against CUNY, attorney’s fees, court costs, etc. Any Breach may be grounds for immediate termination of this Agreement by CUNY.

(j) Security Audit. Upon request by CUNY, CONTRACTOR may be asked to provide a recent independent audit report on security controls. CUNY shall have the right to send its officers and employees into CONTRACTOR’s offices and data centers for inspection of the facilities and operations used in the performance of any work under the Agreement. On the basis of such inspection, specific measures may be required in cases where CONTRACTOR is found to be non-compliant with data security safeguards.

(k) Assistance in Litigation or Administrative Proceedings. CONTRACTOR shall make itself and any employees, subcontractors, or agents assisting it in the performance of its obligations under the Agreement available to CUNY at no cost to CUNY to testify as witnesses in the event of an unauthorized disclosure caused by CONTRACTOR that results in litigation or administrative proceedings against CUNY, its directors, officers, agents or employees based upon a claimed violation of laws relating to security, privacy or arising out of this Agreement.

(l) Family Educational Rights and Privacy Act (FERPA). CONTRACTOR agrees that it may create, receive from or on behalf of CUNY and its Users, or have access to, records and information that are subject to the Family Educational Rights and Privacy Act ("FERPA"), 20 U.S.C. Section 1232g (collectively, the "FERPA Records").

CONTRACTOR represents, warrants, and agrees that it will: (1) hold the FERPA Records in strict confidence and will not use or disclose the FERPA Records except as (a) permitted or required by this Agreement, (b) required by law, or (c) otherwise authorized by CUNY in writing; (2) safeguard the FERPA Records according to commercially reasonable administrative, physical and technical standards that are no less rigorous than the standards by which it protects its own confidential information; and (3) continually monitor its operations and take any action necessary to assure that the FERPA Records are safeguarded in accordance with the terms of this Agreement. At the request of CUNY, CONTRACTOR shall provide CUNY with a written summary of the procedures CONTRACTOR uses to safeguard the FERPA Records.

(m) General Data Privacy Regulation (GDPR). CONTRACTOR has been advised that data stored in the Product by [CUNY and its Authorized Users] in accordance with the permitted uses hereunder may include personal data subject to the requirements of the General Data Protection Regulation (GDPR) (EU 2016/679). CONTRACTOR has also been advised that any data it collects from [CUNY or its Authorized Users] may include personal data subject to the requirements of the GDPR. CONTRACTOR certifies that whether it acts hereunder as a Controller or a Processor of such data, it has implemented appropriate technical and organizational measures in such a manner that processing will meet the requirements of the GDPR and ensure the rights of individuals whose personal data is subject to the GDPR.

Appendix C Artificial Intelligence Clauses for New York State Contracts

The parties to the attached contract, license, amendment or other agreement of any kind (hereinafter, this “Contract”) agree to be bound by the following clauses which are hereby made a part of the contract. Terms used but not defined herein shall have the meanings given to them in the attached Contract.

1. NEW YORK STATE AI POLICY. For further information on the artificial intelligence (“AI”) policy of New York State (the “State”), please refer to New York State Information Technology Policy No: NYS-P24-001 “Acceptable Use of Artificial Intelligence Technologies,” or any predecessor policies.

2. NOTICE. Contractor shall provide CUNY with notice of the use of AI. Such notice shall be clear and unambiguous. AI-specific terms should be explicitly defined and presented separately from the general terms and conditions to ensure clarity and transparency. If new AI terms are included, AI will be clearly described to CUNY by Contractor. Contractor agrees to provide CUNY with written notice at least 90 days prior to the implementation or use of any AI technology in Contractor's software, hardware, or in any dealings or communication with CUNY, CUNY’s employees, contractors or consultants, public users, members of the public, or data-subjects. Such notice shall include a detailed description of the AI technology to be used, its intended purpose, its connections with CUNY, when the AI will be deployed within a tool, whether that AI is open-source, and how the AI will be implemented. CUNY reserves the right to request additional documentation related to AI prior to or while the AI is in use.

3. APPROVAL FOR AI USAGE. For AI tools not integral to the Work, AI tools should be disabled by default. Any AI usage must be approved, in writing, by CUNY. After analysis, should CUNY deem the AI unacceptable and AI functionality cannot be disabled, CUNY reserves the right to terminate this Contract at no cost.

4. COMPLIANCE. The use of AI must comply with all applicable policies and standards set forth by the State, as well as local, state, and federal laws. This includes compliance with regulations related to AI use, security, privacy, and any other laws, regulations, and standards concerning technology that employs AI. CUNY may require Contractor to provide reports that are necessary for auditing purposes by third parties. Reports should include how the AI system uses personally identifiable, confidential, or sensitive information to ensure such use complies with applicable laws, rules, regulations, notices, and policies. Contractor may be asked to provide a recent independent audit report or AI impact assessment as defined by the National Institute of Standards and Technology if the Work incorporates AI. Contractor may be asked to provide information detailing the explainability of the AI technology used.

5. AI TRAINING DATA USAGE PROHIBITION.

Contractor shall not employ confidential information or data of CUNY acquired through working with CUNY or providing services to CUNY to train AI systems without obtaining prior written approval from CUNY. If data is identified and non-aggregate, CUNY should have prior notice that its information will be used for this purpose.

The intended usage of such data for AI training must align with existing data usage rights, and Contractor shall ensure that data privacy and security are maintained throughout the process. If Contractor intends to use any data for training purposes, they must have explicit authorization from CUNY. Contractor may obtain an exception to allow for training with CUNY’s data if that training is being used solely in support of CUNY’s use of

AI.

6. TRANSCRIPTION TOOLS. AI transcription capabilities should be disabled by default, unless specifically requested by CUNY. Users should be made aware of any loss of capabilities and usability if those transcription tools are disabled. Transcription capabilities include the ability to transcribe, summarize, or analyze any meetings, discussions, or proceedings.

7. DATA OWNERSHIP. Data derived from AI outputs is owned by CUNY. All prompts, uploaded content, and outputs created using the AI tool shall remain the exclusive property of CUNY. Contractor shall not use prompts, uploaded content, and outputs to train, retrain, tune, or improve any AI model. Contractor shall not store, retain, or repurpose CUNY’s data for any purpose other than providing the contracted services. Contractor shall not share or distribute CUNY’s data with any third parties.

CUNY may require that, prior to beginning the Work, Contractor staff with access to CUNY data undergo the same background check and training requirements as CUNY staff, at no charge to CUNY.

8. HUMAN OVERSIGHT. If AI is being utilized in decision making, prior to delivery of any output generated, Contractor shall subject such output to thorough human evaluation and oversight. This evaluation shall assess the accuracy, relevance, and appropriateness of the AI-generated content, ensuring the delivery of high-quality, reliable results.