Appendix D Ts and Cs.pdf

Effective Date 01/01/09

Purchase Order Terms and Conditions

1. Offer/Acceptance. If this purchase order (“PO”) refers to Vendor’s bid or proposal, this PO is an ACCEPTANCE of Vendor’s OFFER TO SELL in accordance with the terms and conditions of the “solicitation” identified in Vendor’s bid or proposal. The solicitation includes an RFP, IFB, or any other form of order by Buyer. If a bid or proposal is not referenced, this PO is an OFFER TO BUY, subject to Vendor’s acceptance, demonstrated by Vendor’s performance or written acceptance of this PO.

Any COUNTER-OFFER TO SELL automatically CANCELS this PO, unless a change order is issued by Buyer accepting a counter-offer. This PO shall supersede and control over any Vendor form(s) or part(s) thereof included in or attached to any bid, proposal, offer, acknowledgment, or otherwise, in the event of inconsistencies or contradictions, regardless of any statement to the contrary in such form(s) or parts thereof.

2. Safety Information. All chemicals, equipment and materials proposed and/or used in the performance of this PO shall conform to the requirements of the Occupational Safety and Health Act of 1970. Vendor shall furnish all Material Safety Data Sheets for any regulated chemicals, equipment or hazardous materials at the time of delivery.

3. Changes. Vendor shall furnish products and/or services strictly in accordance with the specifications and price set forth for each item. This PO shall not be modified, superseded or otherwise altered, except in writing signed by purchasing agent and accepted by Vendor. Each shipment received or service performed shall comply with the terms of this PO, notwithstanding invoice terms or acts of Vendor to the contrary, unless this PO has been modified, superseded or otherwise altered in accordance with this section.

4. Delivery. Unless otherwise specified in the solicitation or this PO, delivery shall be FOB destination. Buyer is relying on the promised delivery date, installation, and/or service performance set forth in Vendor’s bid or proposal as material and basic to Buyer’s acceptance. If Vendor fails to deliver or perform as and when promised, Buyer, in its sole discretion, may cancel its order, or any part thereof, without prejudice to its other rights, return all or part of any shipment so made, and charge Vendor with any loss or expense sustained as a result of such failure to deliver or perform as promised. Time is of the essence.

5. Intellectual Property. Except to the extent specifically provided elsewhere in this PO, any State Information (as hereinafter defined), pre-existing State of Colorado (“State”) software, research, reports, studies, data, photographs, negatives or other documents, drawings, models, materials, or work product of any type, including drafts, prepared by Vendor in the performance of its obligations under this PO shall be the exclusive property of the State (collectively, “State Materials”). All State Materials shall be delivered to the State by Vendor upon completion or termination of this PO.

The State’s exclusive rights in any work product prepared by Vendor shall include, but not be limited to, the right to copy, publish, display, transfer, and prepare derivative works. Vendor shall not use, willingly allow, cause or permit any State Materials to be used for any purpose other than the performance of Vendor’s obligations hereunder without the prior written consent of the State. Buyer shall maintain complete and accurate records relating to (i) its use of all Vendor and third party software licenses and rights to use any Vendor or third party software granted under this PO and its attachments to which Buyer is a party and (ii) all amounts payable to Vendor pursuant to this PO and its attachments and Buyer’s its obligations under this PO or to any amounts payable to Vendor in relation to this PO, which records shall contain sufficient information to permit Vendor to confirm Buyer’s compliance with the use restrictions and payment obligations under this PO or to any third-party use restrictions to which Buyer is a party. Vendor retains the exclusive rights, title and ownership to any and all pre-existing materials owned or licensed to Vendor including, but not limited to all pre-existing software, licensed products, associated source code, machine code, text images, audio and/or video, and third-party materials, delivered by Vendor under the PO, whether incorporated in a Deliverable or necessary to use a Deliverable (collectively, “Vendor Property”). Vendor Property shall be licensed to the State as set forth in a State-approved license agreement: (i) entered into as exhibits or attachments to this PO, (ii) obtained by the State from the applicable third-party vendor, or (iii) in the case of open source software, the license terms set forth in the applicable open source license agreement. Notwithstanding anything to the contrary herein, Buyer shall not be subject to any provision incorporated in any exhibit or attachment attached hereto, any provision incorporated in any terms and conditions appearing on any website, any provision incorporated into any click through or online agreements, or any provision incorporated into any other document or agreement between the parties that (i) requires Buyer or the State to indemnify Vendor or any other party, (ii) is in violation of State laws, regulations, rules, fiscal rules, policies, or other State requirements as deemed solely by the State, or (iii) is contrary to any of the provisions herein.

6. Quality. Buyer shall be the sole judge in determining “equals” with regard to quality, price and performance. All products delivered shall be newly manufactured and the current model, unless otherwise specified.

7. Warranties. All provisions and remedies of the Colorado Uniform Commercial Code, CRS, Title 4 (“CUCC”), relating to implied and/or express warranties are incorporated herein, in addition to any warranties contained in this PO or the specifications.

8. Inspection and Acceptance. Final acceptance is contingent upon completion of all applicable inspection procedures. If products or services fail to meet any inspection requirements, Buyer may exercise all of its rights, including those provided in the CUCC. Buyer shall have the right to inspect services provided under this PO at all reasonable times and places. "Services" as used in this section includes services performed or tangible material produced or delivered in the performance of services. If any of the services do not conform to PO requirements, Buyer may require Vendor to perform the services again in conformity with PO requirements, without additional payment. When defects in the quality or quantity of service cannot be corrected by re-performance, Buyer may (a) require Vendor to take necessary action to ensure that future performance conforms to PO requirements and (b) equitably reduce the payment due Vendor to reflect the reduced value of the services performed. These remedies do not limit the remedies otherwise available in this PO, at law, or in equity.

9. Cash Discount. The cash discount period will start from the later of the date of receipt of acceptable invoice, or from date of receipt of acceptable products/services at the specified destination by an authorized Buyer representative.

10. Taxes. Buyer and the State are exempt from all federal excise taxes under Chapter 32 of the Internal Revenue Code [No. 84-730123K] and from all State and local government sales and use taxes [CRS, Title 39, Article 26, Parts I and II]. Such exemptions apply when materials are purchased for the benefit of State, except that in certain political subdivisions (e.g., City and County of Denver) Vendor may be required to pay sales or use taxes even though the ultimate product or service is provided to Buyer. Buyer shall not reimburse such sales or use taxes.

11. Payment. Buyer shall pay Vendor for all amounts due within forty-five (45) days after receipt of products or services and a correct notice of amount due. Interest on the unpaid balance shall begin to accrue on the forty-sixth (46th) day at the rate set forth in CRS § 24-30-202(24) until paid in full. Interest shall not accrue if a good faith dispute exists as to Buyer’s obligation to pay all or a portion of the amount due. Vendor shall invoice Buyer separately for interest on delinquent amounts due, referencing the delinquent payment, number of day’s interest to be paid, and applicable interest rate.

12. Vendor Offset. Under CRS § 24-30-202.4(3.5), the State Controller may withhold payment under the State’s Vendor offset intercept system for debts owed to State agencies for: (a) unpaid child support debts or arrearages; (b) unpaid balances of tax, accrued interest, or other charges specified in CRS § 39-21-101, et seq.; (c) unpaid loans due to the Student Loan Division of the Department of Higher Education; (d) amounts required to be paid to the Unemployment Compensation Fund; and (e) other unpaid debts owing to the State as a result of final agency determination or judicial action.

13. Assignment and Successors. Vendor shall not assign rights or delegate duties under this PO, or subcontract any part of the performance required under this PO, without the express, written consent of Buyer. This PO shall inure to the benefit of and be binding upon Vendor and Buyer and their respective successors and assigns.

Assignment of accounts receivable may be made only upon written notice furnished to Buyer.

14. Indemnification. If any article sold or delivered under this PO is covered by an intellectual property right, patent, copyright, trademark, or application therefore, Vendor shall indemnify, hold harmless and defend, at Vendor’s sole expense, the State and its employees and agents against any and all loss, cost, expenses or liability, including but not limited to attorneys fees, court costs and other legal expenses and damages arising out of a claim that any goods or services, software or work product provided by Vendor under this PO, or the use thereof, infringes a patent, copyright, trademark, trade secret, or any other intellectual property right. If this PO is for services, Vendor shall indemnify, save, and hold harmless the State, its employees and agents, against any and all claims, damages, liability and court awards including costs, expenses, and attorney fees and related costs, incurred as a result of claims arising from death, injury to persons, or damage to real tangible personal property caused by a negligent act or omission by Vendor, or its employees, agents, subcontractors, or assignees arising out of or in connection with performance of services under this PO;

however, the provisions hereof shall not be construed or interpreted as a waiver, express or implied, of any of the immunities, rights, benefits, protection, or other provisions, of the Colorado Governmental Immunity Act, CRS § 24-10-101 et seq., or the Federal Tort Claims Act, 28 USC § 2671 et seq., as applicable, as now or hereafter amended.

15. Independent Contractor. Vendor shall perform its duties hereunder as an independent contractor and not as an employee. Neither Vendor nor any agent or employee of Vendor shall be deemed to be an agent or employee of Buyer. Vendor and its employees and agents are not entitled to unemployment insurance or workers compensation benefits through Buyer and Buyer shall not pay for or otherwise provide such coverage for Vendor or any of its agents or employees. Unemployment insurance benefits will be available to Vendor and its employees and agents only if coverage is made available by Vendor or a third party. Vendor shall pay when due all applicable employment, income, and local head taxes incurred pursuant to this PO. Vendor shall not have authorization, express or implied, to bind Buyer to any agreement, liability or understanding, except as expressly set forth herein. Vendor shall (a) provide and keep in force workers' compensation and unemployment compensation insurance in the amounts required by law, (b) provide proof thereof when requested by Buyer, and (c) be solely responsible for its acts and those of its employees and agents.

16. Communication. All communication concerning administration of this PO, prepared by Vendor for Buyer’s use, shall be furnished solely to purchasing agent.

17. Compliance. Vendor shall strictly comply with all applicable federal and state laws, rules, and regulations in effect or hereafter established, including, without limitation, laws applicable to discrimination and unfair employment practices.

18. Insurance. Vendor shall obtain, and maintain, at all times during the term of this PO, insurance as specified in the solicitation, and provide proof of such coverage as requested by purchasing agent. Notwithstanding the foregoing, Vendor agrees to maintain and agrees to require each subcontractor to maintain in full force and effect a Professional Liability Insurance Policy in the minimum amount of $1,000,000 per occurrence and $1,000,000 in the aggregate, written on an occurrence form that provides coverage for its work undertaken pursuant to this PO. If a policy written on an occurrence form is not commercially available, the claims-made policy shall remain in effect for the duration of this PO and for at least two (2) years beyond the completion and acceptance of the work under this PO, or, alternatively, a two (2) year extended reporting period must be purchased. Additionally, Vendor agrees to maintain Cyber Privacy Insurance for claims and losses with respect to network, internet (cloud) or other data disclosure risks (such as data breaches, releases of confidential information, unauthorized access/use of information, and identity theft) with minimum limits of not less than $1,000,000 per occurrence and $2,000,000 aggregate. Vendor and all Subcontractors shall provide certificates showing insurance coverage required hereunder to the State within seven (7) days of the Effective Date of this PO. No later than fifteen (15) days prior to the expiration of any such coverage, Vendor and each Subcontractor shall deliver to the State or Vendor certificates of insurance evidencing renewals thereof. In addition, upon request by the State at any other time during the term of this PO or any subcontract, Vendor and each Subcontractor shall, within ten (10) days of such request, supply to the State evidence satisfactory to the State of compliance with the provisions of this §18.

19. Termination Prior to Shipment. If Vendor has not accepted this PO in writing, Buyer may cancel this PO by written or oral notice to Vendor prior to shipment of goods or commencement of services.

20. Termination for Cause. (a) If Vendor refuses or fails to timely and properly perform any of its obligations under this PO with such diligence as will ensure its completion within the time specified herein, Buyer may notify Vendor in writing of non-performance and, if not corrected by Vendor within the time specified in the notice, terminate Vendor's right to proceed with the PO or such part thereof as to which there has been delay or a failure. Vendor shall continue performance of this PO to the extent not terminated and be liable for excess costs incurred by Buyer in procuring similar goods or services elsewhere. Payment for completed services performed and accepted shall be at the price set forth in this PO. (b) Buyer may withhold amounts due to Vendor as Buyer deems necessary to reimburse Buyer for excess costs incurred in curing, completing or procuring similar goods and services.(c) If after rejection, revocation, or other termination of Vendor's right to proceed under the CUCC or this clause, Buyer determines for any reason that Vendor was not in default or the delay was excusable, the rights and obligations of Buyer and Vendor shall be the same as if the notice of termination had been issued pursuant to termination under §21.

21. Termination in Public Interest. Buyer is entering into this PO for the purpose of carrying out the public policy of the State, as determined by its Governor, General Assembly, and Courts. If this PO ceases to further the public policy of the State, Buyer, in its sole discretion, may terminate this PO in whole or in part and such termination shall not be deemed to be a breach of Buyer’s obligations hereunder. This section shall not apply to a termination for Vendor’s breach, which shall be governed by §20. Buyer shall give written notice of termination to Vendor specifying the part of the PO terminated and when termination becomes effective. Upon receipt of notice of termination, Vendor shall not incur further obligations except as necessary to mitigate costs of performance. For services or specially manufactured goods, Buyer shall pay

(a) reasonable settlement expenses, (b) the PO price or rate for supplies and services delivered and accepted, (c) reasonable costs of performance on unaccepted supplies and services, and (d) a reasonable profit for the unaccepted work. For existing goods, Buyer shall pay (e) reasonable settlement expenses, (f) the PO price for goods delivered and accepted, (g) reasonable costs incurred in preparation for delivery of the undelivered goods, and (h) a reasonable profit for the preparatory work. Buyer’s termination liability under this section shall not exceed the total PO price plus a reasonable cost for settlement expenses. Vendor shall submit a termination proposal and reasonable supporting documentation, and cost and pricing data as required by CRS § 24-106-101, upon request of Buyer.

22. PO Approval. This PO shall not be valid unless it is executed by purchasing agent. Buyer shall not be responsible or liable for products or services delivered or performed prior to proper execution hereof.

23. Fund Availability. Financial obligations of Buyer payable after the current fiscal year are contingent upon funds for that purpose being appropriated, budgeted and otherwise made available. If this PO is funded in whole or in part with federal funds, this PO is subject to and contingent upon the continuing availability of federal funds for the purposes hereof. Buyer represents that it has set aside sufficient funds to make payment for goods delivered in a single installment, in accordance with the terms of this PO.

24. Choice of Law. State laws, rules and regulations shall be applied in the interpretation, execution, and enforcement of this PO. The CUCC shall govern this PO in the case of goods unless otherwise agreed in this PO. Any provision included or incorporated herein by reference which conflicts with such laws, rules, and regulations is null and void. Any provision incorporated herein by reference which purports to negate this or any other provision in this PO in whole or in part shall not be valid or enforceable or available in any action at law, whether by way of complaint, defense, or otherwise. Unless otherwise specified in the solicitation or this PO, venue for any judicial or administrative action arising out of or in connection with this PO shall be in Denver, Colorado. Vendor shall exhaust administrative remedies in CRS § 24-109- 106, prior to commencing any judicial action against Buyer.

25. Public Contracts for Services. [Not Applicable to offer, issuance, or sale of securities, investment advisory services, fund management services, sponsored projects, intergovernmental POs, or information technology services or products and services] Vendor certifies, warrants, and agrees that it does not knowingly employ or contract with an illegal alien who will perform work under this PO and will confirm the employment eligibility of all employees who are newly hired for employment in the United States to perform work under this PO, through participation in the E-Verify Program or the Department program established pursuant to CRS § 8-17.5-102(5)(c), Vendor shall not knowingly employ or contract with an illegal alien to perform work under this PO or enter into a contract or PO with a subcontractor that fails to certify to Vendor that the subcontractor shall not knowingly employ or contract with an illegal alien to perform work under this PO. Vendor shall (a) not use E-Verify Program or Department program procedures to undertake pre-employment screening of job applicants during performance of this PO, (b) notify subcontractor and Buyer within three days if Vendor has actual knowledge that subcontractor is employing or contracting with an illegal alien for work under this PO, (c) terminate the subcontract if subcontractor does not stop employing or contracting with the illegal alien within three days of receiving notice, and (d) comply with reasonable requests made in the course of an investigation, undertaken pursuant to CRS § 8-17.5-102(5), by the Colorado Department of Labor and Employment. If Vendor participates in the Department program, Vendor shall deliver to the Buyer a written, notarized affirmation that Vendor has examined the legal work status of such employee, and shall comply with all of the other requirements of the Department program. If Vendor fails to comply with any requirement of this provision or CRS § 8-17.5-101 et seq., Buyer may terminate this PO for breach and, if so terminated, Vendor shall be liable for damages.

26. Public Contracts with Natural Persons. Vendor, if a natural person eighteen (18) years of age or older, hereby swears and affirms under penalty of perjury that he or she

(a) is a citizen or otherwise lawfully present in the United States pursuant to federal law, (b) shall comply with the provisions of CRS § 24-76.5-101 et seq., and (c) has produced a form of identification required by CRS § 24-76.5-103 prior to the date Vendor delivers goods or begins performing services under terms of the PO.

27. Vendor Records. Vendor shall make, keep, maintain, and allow inspection and monitoring by the State of a complete file of all records, documents, communications, notes and other written materials, electronic media files, and communications, pertaining in any manner to the work or the delivery of services or goods Vendor shall maintain such records until the last to occur of: (i) a period of three (3) years after the date this PO expires or is sooner terminated, (ii) final payment is made under this PO,

(iii) the resolution of any pending PO matters, or (iv) if an audit is occurring, or Vendor has received notice that an audit is pending, until such audit has been completed and its findings have been resolved (collectively, the “Record Retention Period”). Vendor shall permit the State, the federal government and any other duly authorized agent of a governmental agency to audit, inspect, examine, excerpt, copy and/or transcribe Vendor’s records related to this PO during the Record Retention Period for a period of three (3) years following termination of this PO or final payment thereunder, whichever is later, to assure compliance with the terms thereof or to evaluate performance thereunder. The State reserves the right to inspect the work at all reasonable times and places during the PO term, including any extensions or renewals.

If the work fails to conform to the requirements of the PO, the State may require Vendor to promptly bring the work into conformity with PO requirements, at Vendor’s sole expense. If the work cannot be brought into conformance by re-performance or other corrective measures, the State may require Vendor to take necessary action to ensure that future performance conforms to PO requirements and exercise the remedies available under the PO, at law or in equity, in lieu of or in conjunction with such corrective measures. Vendor shall permit the State, the federal government, and governmental agencies having jurisdiction, in their sole discretion, to monitor all activities conducted by Vendor pursuant to the terms of this PO using any reasonable procedure, including, but not limited to: internal evaluation procedures, examination of program data, special analyses, on-site checking, formal audit examinations, or any other procedures. All monitoring controlled by the State shall be performed in a manner that shall not unduly interfere with Vendor’s performance under this PO. If an audit is performed on Vendor’s records for any State fiscal year covering a portion of the PO term, Vendor shall submit a copy of the final audit report to the State or its principal representative at the address specified by the State. Vendor shall ensure the provisions of this paragraph apply to any subcontract related to performance under the PO. Vendor shall, at Vendor’s sole expense, reconstruct any records not preserved or retained as required by this paragraph.

28. Confidential Information – State Records and Data. Vendor shall comply with and shall cause each of its Subcontractors and any other party performing Work under the PO to comply with the provisions of this PO if it becomes privy to State Information in connection with its performance. “State Information” means the combination of State Confidential Information and State Records. “State Confidential Information” means all information, data, records, and documentary materials which are of a sensitive nature and belong to the State regardless of physical form or characteristics, including but not limited to any non-public State records, sensitive State data, protected State data, State personnel records, personally identifiable information (“PII”), federal tax information (“FTI”), payment card information (“PCI”), and other information or data concerning individuals, which has been communicated, furnished or disclosed by the State to Vendor. Notwithstanding the foregoing, State Confidential Information shall not include State Records. “State

Records” means all information, data, records, and documentary materials which are not sensitive and belong to the State regardless of physical form or characteristics, including but not limited to any public State records, non-sensitive State data, and other information or data concerning individuals that is not deemed confidential but nevertheless belongs to the State, which has been communicated, furnished or disclosed by the State to Vendor which (i) is subject to disclosure pursuant to the Colorado Open Records Act, CRS § 24-72-200.1, et seq.; (ii) is already known to Vendor without restrictions at the time of its disclosure by Vendor; (iii) is or subsequently becomes publicly available without breach of any obligation owed by Vendor to the State; (iv) is disclosed to Vendor, without confidentiality obligations, by a third party who has the right to disclose such information; or (v) was independently developed without reliance on any State Confidential Information. Notwithstanding the foregoing, State Records shall not include State Confidential Information.

29. Confidentiality. Vendor shall comply with all laws and regulations concerning confidentiality of State Confidential Information. Any request or demand by a third party for State Information in the possession of Vendor shall be immediately forwarded to the State’s principal representative.

30. Notification. Vendor shall provide its agents, employees, Subcontractors and assigns who may come into contact with State Confidential Information with a written explanation of the confidentiality requirements herein, to which they are subject, before permitting them to access such State Information.

31. Use, Security, and Retention. State Information of any kind shall be stored, processed, or transferred only in or to facilities located within the United States, and shall not be distributed or sold to any third party, retained in any files or otherwise, or used by Vendor or its agents in any way, except as authorized by this PO, by law, or approved in writing by the State. Vendor shall provide and maintain a secure environment that ensures confidentiality of all State Confidential Information wherever located. Neither Vendor nor its Subcontractors shall have any rights to use or access any OIT or other State agency data or information, except with the prior approval of the State.

32. Protection. Vendor is responsible for the protection and security of all State Information provided to it by the State. If Vendor provides physical or logical storage, processing or transmission of, or retains, stores or is given, State Information, Vendor shall, and shall cause its Subcontractors to, (i) provide physical and logical protection for all related hardware, software, applications and data that meet or exceed industry standards and requirements as set forth in this PO; (ii) maintain network, system, and application security, which includes network firewalls, intrusion detection, and annual security testing; (iii) comply with State and federal regulations and guidelines related to security, confidentiality and auditing; (iv) ensure that security is not compromised by unauthorized access to computers, program, software, databases, or other electronic environments; and (v) shall promptly report all Incidents to a representative of the Office of Information Security (“OIS”). Vendor shall provide the State with access, subject to Vendor’s reasonable access security requirements, seven (7) days a week, twenty-four (24) hours a day, for the purpose of inspecting and monitoring access and use of State Information, maintaining State systems, and evaluating physical and logical security control effectiveness.

33. Compliance. Vendor shall review and shall cause its Subcontractors to review, on a semi-annual basis, all OIS policies and procedures, which OIS has promulgated pursuant to CRS §§ 24-37.5-401 through 406 and 8 CCR § 1501-5 and posted at http://oit.state.co.us/ois, to ensure compliance with the standards and guidelines published therein. Vendor shall cooperate, and shall cause its Subcontractors to cooperate, with the performance of security audit and penetration tests by OIS or its designee.

34. Background Checks. Vendor shall perform, and shall cause its Subcontractor’s to perform, in a form reasonably acceptable to the State, current background checks on all of its respective employees and agents performing services or having access to State Information provided under this PO. A background check performed within thirty (30) days prior to the date such employee or agent begins performance or obtains access to State Information shall be deemed to be current.

35. Delivery and Support. The State, in its sole discretion may securely deliver State Information directly to the facility where such data is used to perform the Work. State Information is not to be maintained or forwarded to or from any other facility or location except for the authorized and approved purposes of backup and disaster recovery purposes.

36. Incident Notice. If Vendor becomes aware of an Incident involving any State Information, it shall notify the State immediately and cooperate with the State regarding recovery, remediation, and the necessity to involve law enforcement, if any.

Unless Vendor can establish that Vendor or any of its Subcontractors is not the cause or source of the Incident, Vendor shall be responsible for the cost of notifying each person whose personal information may have been compromised by the Incident.

37. Incident Remediation. Vendor shall be responsible for determining the cause of an Incident, and for producing a remediation plan to reduce the risk of incurring a similar type of breach in the future. Vendor shall present its analysis and remediation plan to the State within ten (10) days of notifying the State of an Incident. The State reserves the right to adjust this plan, in its sole discretion. If Vendor cannot produce its analysis and plan within the allotted time, the State, in its sole discretion, may perform such analysis and produce a remediation plan, and Vendor shall reimburse the State for the reasonable costs thereof.

38. Incident Liability. Disclosure of State Information by Vendor or any Subcontractor for any reason may be cause for legal action by third parties against

Vendor, the State or their respective agents. Vendor shall indemnify, save, and hold harmless the State, its employees and agents against any and all claims, damages, liability and court awards including costs, expenses, and attorney fees incurred as a result of any act or omission by Vendor, or its employees, agents, Subcontractors, or assignees pursuant to this PO. Notwithstanding any other provision of this PO, Vendor shall be liable to the State for all consequential and incidental damages arising from an Incident caused by Vendor or its Subcontractors.

39. End-of-Agreement Data Handling. Upon request by the State made before or within sixty (60) days after the effective date of termination of the PO, Vendor will make available to the State a complete and secure (i.e. encrypted and appropriately authenticated) download file of all data, including, but not limited to, all State Information, schema and transformation definitions, or delimited text files with documented, detailed schema definitions along with attachments in its native format.

The Parties agree that on the termination of the provision of data processing services, the Vendor shall, at the choice of the State, return all State Information provided by the State to Vendor, and the copies thereof, to the State, or Vendor shall destroy all such State Information and certify to the State that it has done so. If legislation imposed upon the Vendor prevents it from returning or destroying all or part of the State Information provided by the State to Vendor, Vendor warrants that it will guarantee the confidentiality of all State Information provided by the State to Vendor and will not actively process such data anymore.

40. Disposition of Data. The State retains the right to use the established operational services to access and retrieve State Information stored on Vendor’s infrastructure at its sole discretion. The Vendor and Subcontractor warrant that upon request of the State or of the supervisory authority, the Vendor will submit its data processing facilities for an audit of the measures referred to in §32. The State reserves all right, title and interest, including all intellectual property and proprietary rights, in and to system data, State Information and all related data and content.

41. Safeguarding PII Data. If Vendor or any of its Subcontractors will or may receive PII under this PO, Vendor shall provide for the security of such PII, in a form acceptable to the State, including, without limitation, non-disclosure, use of appropriate technology, security practices, computer access security, data access security, data storage encryption, data transmission encryption, security inspections and audits. Vendor shall take full responsibility for the security of all PII data in its possession or in the possession of its Subcontractors, and shall hold the State harmless for any damages or liabilities resulting from the unauthorized disclosure or loss thereof.

42. Safeguarding FTI Data. If Vendor or any of its Subcontractors will or may receive FTI under this PO, Vendor shall provide for the security of the FTI, in a form acceptable to the State and in accordance with State and federal law and §45. Security safeguards shall include, without limitation, supervision by responsible employees, approval of Subcontractors as required by State or federal law, non-disclosure of information other than as necessary in the performance of Vendor’s or its Subcontractor’s obligations under this PO, non-disclosure protections, proper accounting and storage of information, civil and criminal penalties for non-compliance as provided by law, certifications and inspections. Vendor shall comply with the requirements of of IRS Publication 1075, Tax Information Security Guidelines For Federal, State and Local Agencies, revised and effective January 1, 2014, found at:

http://www.irs.gov/pub/irs-pdf/p1075.pdf and incorporated herein by this reference.

43. Safeguarding PCI Data. If Vendor or any of its Subcontractors will or may receive PCI Data under this PO, Vendor shall provide for the security of the PCI data, in accordance with PCI Data Security Standard 1.1. Security safeguards shall include, without limitation, supervision by responsible employees, approval of Subcontractors as required by State or federal law, non-disclosure of information other than as necessary in the performance of Vendor’s or its Subcontractor’s obligations under this PO, non-disclosure protections, proper accounting and storage of information, civil and criminal penalties for non-compliance as provided by law, certifications and inspections.

44. Safeguarding CJI Data. If Vendor or any of its Subcontractors will or may receive CJI Data under this PO, Vendor shall provide for the security of CJI Data, in accordance with the US Department of Justice, Federal Bureau of Investigation, Criminal Justice Information Services (CJIS) Security Policy, Version 5.3, dated 8/4/2014, found online at: http://www.fbi.gov/about-us/cjis/cjis-security-policy-resource-center and incorporated herein by this reference.

45. Safeguarding HIPAA Data. If Vendor or any of its Subcontractors will or may receive HIPAA Data under this PO, Vendor shall provide for the security of the HIPAA Data in accordance with the Health Insurance Portability and Accountability Act of 1996, 42 USC § 1320d-1320d-8 (“HIPAA”) as amended by the American Recovery and Reinvestment Act of 2009 (“ARRA”)/HITECH Act (PL 111-005), and its implementing regulations promulgated by the US Department of Health and Human Services, 45 CFR Parts 160, 162, and 164 (the “HIPAA Rules”) and other applicable laws, as amended and Vendor shall agree to exectue separate the State’s approved HIPAA Business Associate Addendum.

46. Confidentiality Of Taxpayer Information Certification. The State has legal responsibilities to safeguard the confidentiality of taxpayer information obtained and used in the course of this PO for the State. As a contractor providing services to and for the benefit of the State, Vendor is required to uphold these responsibilities as a condition of being allowed access to taxpayer information. These obligations apply to information that is discussed, collected or maintained verbally, in paper, or electronic format. Vendor understands that in the course of its provision of services as a Vendor http://www.irs.gov/pub/irs-pdf/p1075.pdf http://www.fbi.gov/about-us/cjis/cjis-security-policy-resource-center http://www.fbi.gov/about-us/cjis/cjis-security-policy-resource-center for the State, Vendor’s employees may receive or learn of taxpayer information that is confidential by law. The confidentiality of all taxpayer information provided by the State, or learned in the course of Vendor’s duties as a Vendor for the State, shall be maintained at all times in accordance with safeguards set forth under CRS § 39-21- 113(4), as amended, 1 CCR § 201-1 Regulation 39-21-113(4), as amended, 26 CFR § 6103 and the associated US Treasury Regulations, as amended, and IRS Publication 1075. This confidential taxpayer information shall not be disclosed, re-disclosed, distributed, sold or shared with any third party nor used in any way except as expressly authorized by the State. Information compiled, hosted and retained on electronic media or in databases for the use of the State shall be secured and adhere to the standards of protection set forth under Federal and State safeguards for the protection of electronically stored taxpayer information. Disclosure of such confidential taxpayer information may be cause for legal action against Vendor and any involved third party. Vendor shall immediately notify the State of any breach of security resulting in any inadvertent or intentional disclosure of confidential taxpayer information. The State shall not be in any way responsible for defense of any action against Vendor for a disclosure of confidential taxpayer information. No disclosure shall be made by Vendor to a Subcontractor or third party without the expressed written consent of the State. Vendor shall not retain any confidential taxpayer information once Vendor has completed legal services under the terms of PO for the State, and shall return all confidential taxpayer information to the State. Vendor shall return all confidential taxpayer information immediately upon notice and demand from the State. Vendor hereby acknowledges that it shall remain in compliance with all State and Federal laws and the aforementioned terms and conditions pertaining to the protection, security, and confidentiality of taxpayer information provided by the State or learned of in the course of its duties as a contractor for the State.

47. Force Majeure. Neither Party will be liable for its non-performance or delayed performance if caused by a Force Majeure event. A Party that becomes aware of a Force Majeure event that will significantly delay performances shall notify the other Party promptly (but in no event later than fifteen (15) days) after it discovers the Force Majeure event. If a Force Majeure event occurs, the Parties shall execute an amendment in accordance with the terms of this PO to extend the PO for a time period that is reasonable under the circumstances and in accordance with State of Colorado Fiscal Rules and State of Colorado Controller Policies.

48. License or Use Audit Rights. Vendor shall have the right, at any time during and throughout the PO term, but not more than once (1) per Fiscal Year to request via written notice (“Audit Request”) that the State certify its compliance with any applicable license or use restrictions and limitations (“Audit”) contained in this PO or its exhibits. The State shall complete the Audit and provide certification of its compliance to Vendor (“Audit Certification”) within one hundred twenty (120) days following the State’s receipt of the Audit Request. If upon receipt of the State’s Audit Certification, the Parties reasonably determine: (i) the State’s use of licenses, use of software, use of programs, or any other use during the Audit period exceeded the use restrictions and limitations contained in this PO or its exhibits (“Overuse”) and (ii) that the State would have been or is then required to purchase additional maintenance and/or services (“Maintenance”), Vendor shall provide written notice to the State identifying any Overuse or required Maintenance and request that the State brings its use into compliance with such use restrictions and limitations. Notwithstanding anything to the contrary in this PO and its exhibits, or incorporated as a part of Vendor’s or any Subcontractor’s website, click-through or online agreements, third-party agreements, or any other documents or agreements between the Parties, the State shall not be liable for the costs associated with any Overuse or Maintenance beyond the then current fiscal year, regardless of whether the State may have been notified in advance of such costs.

49. Press Release. Vendor shall not initiate any press and/or media contacts nor respond to press and/or media requests regarding this PO and/or any related matters concerning the State without the prior written approval of the State representative listed on the cover page of this PO.

50. Modification. Modification. Except as specifically provided in this PO, modifications of this PO shall not be effective unless agreed to in writing by the Parties in an amendment to this PO, properly executed and approved in accordance with applicable Colorado State law and State Fiscal Rules. This PO is subject to such modifications as may be required by changes in Federal or Colorado State law, or their implementing regulations. Any such required modification shall automatically be incorporated into and be part of this PO on the effective date of such change, as if fully set forth herein.

51. Conflicts of Interest. Vendor acknowledges that with respect to this PO, even the appearance of a conflict of interest is harmful to the State’s interests. Absent the State’s prior written approval, Vendor shall refrain from any practices, activities, or relationships that reasonably may appear to be in conflict with the full performance of Vendor’s obligations to the State hereunder. If a conflict or appearance of a conflict of interest exists, or if Contractor is uncertain as to such, Vendor shall submit to the State a disclosure statement setting forth the relevant details for the State’s consideration.

Failure to promptly submit a disclosure statement or to follow the State’s direction in regard to the actual or apparent conflict constitutes a breach of this PO.

52. Defined Terms. “Criminal Justice Information (CJI) Data” means information collected by criminal justice agencies that is needed for the performance of their legally authorized, required function, which includes, but is not limited to, wanted person information; missing person information; unidentified person information;

stolen property information; criminal history information; information compiled in the course of investigation of crimes that are known or believed on reasonable grounds to have occurred, including information on identifiable individuals; and information on identifiable individuals compiled in an effort to anticipate, prevent, or monitor possible criminal activity. “Deliverable” means the outcome to be achieved or output to be provided, in the form of a tangible or intangible object that is produced as a result of Vendor’s Work that is intended to be delivered to the State by Vendor.

Examples of Deliverables include, but are not limited to, report(s), document(s), server upgrade(s), software license(s), and may be composed of multiple smaller deliverables. “Federal Tax Information (FTI) Data” means federal or state tax returns, return information, and such other tax-related information as may be protected by State and federal law. “Fiscal Year” means the State’s fiscal year, which begins on July 1 of each calendar year and ends on June 30 of the following calendar year.

“Force Majeure” means failures or delays in performance by a Party due to causes beyond its reasonable control, including war, strikes, lockouts, fire, flood, storm, or other acts of God. Both Parties agree to use their best efforts to minimize the effects of such failures or delays. “Goods” means tangible material acquired, produced, or delivered by Vendor either separately or in conjunction with the Services Vendor renders hereunder. “Health Insurance Portability and Accountability Act (HIPAA) Data” means any information, whether oral or recorded in any form or medium, that

(i) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (ii) relates to the past, present, or future physical or mental health or condition of any individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual; and (iii) identifies the individual or with respect to which there is reasonable basis to believe the information can be used to identify the individual. HIPAA Data includes, but is not necessarily limited to, protected health information as defined in 45 CFR § 160.103 and 45 CFR §

164.501. “Incident” means an accidental or deliberate event that results in or constitutes an imminent threat of the unauthorized access, loss, disclosure, modification, disruption, or destruction of communication and information resources of the State pursuant to CRS § 24-37.5-401 et seq. Incidents include, but are not limited to (i) successful attempts to gain unauthorized access to a State system or State Information regardless of where such information is located; (ii) unwanted disruption or denial of service; (iii) the unauthorized use of a State system for the processing or storage of data; or (iv) changes to State system hardware, firmware, or software characteristics without the State’s knowledge, instruction, or consent. “Payment Card Information (PCI) Data” means any data related to card holders’ names, credit card numbers, or other credit card information as may be protected by State and federal law. “Personally Identifiable Information (PII) Data” means information about an individual collected by the State or any other governmental entity that could reasonably be used to identify such individual as defined in CRS § 24-72-501(2) and includes, but is not limited to, any combination of (i) first and last name, (ii) first name or first initial and last name, (iii) residence or other physical address, (iv) electronic mail address, (v) telephone number, (vi) birth date, (vii) credit card information, (viii) social security number, (ix) driver’s license number, (x) identification card number, or

(xi) any other information that identifies an individual personally. “Services” means the required services to be performed by Vendor pursuant to this PO. “State Confidential Information” means all information, data, records, and documentary materials which are of a sensitive nature and belong to the State regardless of physical form or characteristics, including but not limited to any non-public State records, sensitive State data, protected State data, State personnel records, PII, FTI, PCI, and other information or data concerning individuals, which has been communicated, furnished, or disclosed by the State to Vendor. Notwithstanding the foregoing, State Confidential Information shall not include State Records. “State Controller” means the Colorado State Controller or authorized designee of the Colorado State Controller.

“State Information” means the combination of State Confidential Information and State Records.