Appendix F - Agency SaaS Software Services License Requirements Agreement.docx

Contract #

PA Supplier ID Number:

APPENDIX F: AGENCY SAAS SOFTWARE/SERVICES LICENSE

REQUIREMENTS AGREEMENT

BETWEEN

THE COMMONWEALTH OF PENNSYLVANIA,

ACTING BY AND THROUGH THE [INSERT NAME OF AGENCY]

AND

[INSERT FULL NAME OF LICENSOR]

This Agency SaaS Software/Services License Requirements Agreement (“Agreement”) is entered into by and between __________ (“Licensor”), with its principal offices located at __________________ and the Commonwealth of Pennsylvania (“Commonwealth”), acting by and through the _________________________________ (“Agency”) with its principal offices located at _____________________________.

The parties, intending to be legally bound, agree as follows:

1. Order of Precedence. The terms and conditions of this Agreement, to the extent a conflict exists, supersede and take precedence over the terms and conditions of the Licensor’s [insert the name of the Licensor’s standard End User License/Software License Agreement], which is attached to this Agreement as Exhibit A. The terms of this Agreement supersede and take precedence over the terms included in any quote, purchase order, terms of any shrink-wrap agreement included with the Licensed Products, terms of any click through agreement included with the Licensed Products or any other terms purported to apply to the Licensed Products. The products specified in Attachment 1, along with maintenance, support and services for said products, shall be referred to as “Licensed Products.”

2. Effective Date. The effective date of this Agreement shall be the date that it has been fully executed by the Licensor and by the Agency and all approvals required by Commonwealth contracting procedures have been obtained.

3. List of Licensed Products.

(a) Attached hereto and made a part of this Agreement by reference is Attachment 1, which lists the Licensed Products that are licensed under this Agreement. With the consent of Agency, the list of Licensed Products on Attachment 1 may be updated by the Licensor providing the Agency with a revised Attachment 1 that adds the new product to the list. The Agency, in its sole discretion, may consent either via written communication directly to the Licensor or, if applicable, by providing the Commonwealth’s reseller with a copy of Licensor’s notification to update Attachment 1.

(b) No amendment will be required to add a new Licensed Product to the list. If, however, the Licensor desires to add a new Licensed Product to the list that requires additional licensing terms or other requirements, either an amendment to this Agreement or a new agreement will be required.

4. Applicable Law and Forum. This Agreement is governed by and must be interpreted and enforced in accordance with the laws of the Commonwealth of Pennsylvania (without regard to any conflict of laws provisions) and the decisions of the Pennsylvania courts. The Licensor consents to the jurisdiction of any court of the Commonwealth of Pennsylvania and any federal courts in Pennsylvania, and waives any claim or defense that such forum is not convenient or proper. Any Pennsylvania court or tribunal has in personam jurisdiction over the Licensor, and the Licensor consents to service of process in any manner authorized by Pennsylvania law. This provision may not be interpreted as a waiver or limitation of the Commonwealth’s rights or defenses.

5. Indemnification.

(a) Licensor Obligations. The Licensor shall indemnify the Commonwealth against all third-party claims, suits, demands, losses, damages, costs, and expenses, including without limitation, litigation expenses, attorneys' fees, and liabilities, arising out of or in connection with any activities performed by the Licensor or its employees and agents that are related to this Agreement, as determined by the Commonwealth in its sole discretion.

(b) Commonwealth Attorneys Act. The Commonwealth shall provide the Licensor with prompt notice of any claim or suit of which it learns. Pursuant to the Commonwealth Attorneys Act (71 P.S. Section 732-101, et seq.), the Office of Attorney General (OAG) has the sole authority to represent the Commonwealth in actions brought against the Commonwealth. The OAG may, however, in its sole discretion and under any terms as it deems appropriate, delegate its right of defense. If OAG delegates the defense to the Licensor, the Commonwealth will cooperate with all reasonable requests of Licensor made in the defense of such suits.

(c) Settlement. Notwithstanding the above, neither party may enter into a settlement of any claim or suit without the other party's written consent, which will not be unreasonably withheld. The Commonwealth may, in its sole discretion, allow the Licensor to control the defense and any related settlement negotiations.

6. Sovereign Immunity.

No provisions of this Agreement may be construed to waive or limit the sovereign immunity of the Commonwealth of Pennsylvania or its governmental sub-units.

7. Patent, Copyright, Trademark and Trade Secret Protection.

(a) The Licensor shall, at its expense, defend, indemnify and hold the Commonwealth harmless from any suit or proceeding which may be brought by a third party against, the Commonwealth, its departments, officers or employees for the alleged infringement of any United States patents, copyrights, trademarks or trade dress, or for a misappropriation of a United States trade secret arising out of performance of this Agreement (“Claim”), including all Licensed Products provided by the Licensor. For the purposes of this Agreement, “indemnify and hold harmless” shall mean the Licensor’s obligation to (a) pay any judgments, fines and penalties finally awarded by a court of competent jurisdiction, governmental/administrative body or any settlements reached pursuant to a Claim and (b) reimburse the Commonwealth for its reasonable administrative costs or expenses, including without limitation reasonable attorney’s fees, it necessarily incurs in handling the Claim. The Commonwealth shall give the Licensor prompt notice of any such claim of which it learns. Pursuant to the Commonwealth Attorneys Act, Act of October 15, 1980, P.L. 950, No. 164, as amended, 71 P. S. §§ 732-101—732-506, the Office of Attorney General (“OAG”) has the sole authority to represent the Commonwealth in actions brought against the Commonwealth. The OAG, however, in its sole discretion, and under the terms the OAG deems appropriate, may delegate its right of defense of a Claim. If the OAG delegates the defense to the Licensor, the Commonwealth will cooperate with all reasonable requests of the Licensor made in the defense of and/or settlement of a Claim. The Licensor shall not, without the Commonwealth’s consent, enter into any settlement agreement which (a) states or implies that the Commonwealth has engaged in any wrongful or improper activity other than the innocent use of the material which is the subject of the Claim, (b) requires the Commonwealth to perform or cease to perform any act or relinquish any right, other than to cease use of the material which is the subject of the Claim, or (c) requires the Commonwealth to make a payment which the Licensor is not obligated by this Agreement to pay on behalf of the Commonwealth. In all events, the Commonwealth shall have the right to participate in the defense of any such suit or proceeding through counsel of its own choosing. It is expressly agreed by the Licensor that, in the event it requests that the Commonwealth provide support to the Licensor in defending any such Claim, the Licensor shall reimburse the Commonwealth for all necessary expenses (including attorneys’ fees, if such are made necessary by the Licensor’s request) incurred by the Commonwealth for such support. The Licensor, at its own expense, shall provide whatever cooperation the OAG requests in the defense of the Claim.

(b) The Licensor shall exercise reasonable due diligence to prevent claims of infringement on the rights of third parties. The Licensor certifies that, in all respects applicable to this Agreement, it has exercised and will continue to exercise due diligence to ensure that all Licensed Products provided under this Agreement do not infringe on the patents, copyrights, trademarks, trade dress, trade secrets or other proprietary interests of any kind which may be held by third parties.

(c) If the defense of a Claim and the authority to control any potential settlements of a Claim is delegated to the Licensor, the Licensor shall pay all damages and costs finally awarded against the Commonwealth or agreed to by the Licensor in any settlement. If information and assistance are furnished by the Commonwealth at the Licensor’s written request, it shall be at the Licensor’s sole expense.

(d) If any Licensed Product furnished hereunder is likely to (in the Licensor’s opinion) or does become subject to a claim of infringement of a United States patent, copyright, trade dress or trademark, or for a misappropriation of trade secret, or is held to constitute infringement and the use of the Licensed Product is enjoined, without diminishing the Licensor’s obligation to satisfy any final award, the Licensor may, at its option and expense:

(i) Replace or substitute functional equivalents for the Licensed Product;

(ii) Modify the Licensed Product so that it is no longer infringing;

(iii) Re-perform the Services in a non-infringing manner; or

(iv) Obtain the rights necessary for the Licensor to continue performance under this Agreement or obtain the rights for the Agency to continue the use of the Licensed Product.

(e) If the use of any Licensed Product is enjoined and the Licensor is unable to provide any remedy set forth in subsection (d) above, the Licensor, upon return of the Licensed Product, shall refund to the Agency:

(i) the fee paid for the infringing Licensed Product, less the amount for the period of usage of the Licensed Product; and

(ii) the pro-rated portion of any maintenance fees representing the time remaining in any period of services for which payment was made.

(f) The obligations of the Licensor under this section survive the termination of this Agreement.

(g) Notwithstanding the above, the Licensor shall have no obligation under this section to the extent a Claim arises from:

(i) modification of any Licensed Products provided by the Agency, the Commonwealth or a third party acting under the direction of the Agency or the Commonwealth;

(ii) any material provided by the Agency or the Commonwealth to the Licensor and incorporated into, or used to prepare any Licensed Products;

(iii) use of any Licensed Product after the Licensor recommends discontinuation because of possible or actual infringement and has provided one of the remedies under subsection (d) or subsection (e) above;

(iv) use of any Licensed Product in other than the specified operating environment;

(v) the combination, operation, or use of the Licensed Products with other products, services, or deliverables not provided by the Licensor as a system or the combination, operation, or use of the Licensed Products, service, or deliverable, with any products, data, or apparatus that the Licensor did not provide;

(vi) infringement of a non-Licensed Product alone;

(vii) The Agency’s use of any Licensed Product beyond the scope contemplated by this Agreement; or

(viii) The Agency’s failure to use corrections or enhancements made available to the Agency by the Licensor at no charge.

8. Virus, Malicious, Mischievous or Destructive Programming.

(a) The Licensor warrants that the Licensed Products as delivered by the Licensor does not contain any viruses, worms, Trojan Horses, or other malicious or destructive code to allow unauthorized intrusion upon, disabling of, or erasure of the Licensed Products (each a “Virus”). However, the Licensed Products may contain a key limiting use to the scope and quantity of the license(s) granted, and license keys issued by the Licensor for temporary use are time-sensitive.

(b) The Licensor shall be liable to the Agency for any damages, costs, fines, remedial measures incurred by the Agency or the Commonwealth and shall indemnify the Agency and the Commonwealth against any Third Party claims (in accordance with Section 5, Indemnification) if the Licensor or any of its employees, subcontractors or consultants introduces a virus or malicious, mischievous or destructive programming into the Licensed Product or the Agency’s, the Commonwealth’s or Third Party’s software, data, systems or computer networks.

9. Limitation of Liability.

(a) Except as otherwise provided in this Agreement, the Licensor’s liability to the Agency under this Agreement shall be limited to the greater of $500,000 or the total dollar amount of purchase orders issued for Licensed Products and services covered by this Agreement during the twelve (12)-month period prior to the event giving rise to the damage claim. This limitation does not apply to damages:

(i) for bodily injury;

(ii) for death;

(iii) for gross negligence and willful or unlawful misconduct;

(iv) to real property or tangible personal property for which the Licensor is legally liable;

(v) under Section 7, Patent, Copyright, Trade Secret and Trademark Protection;

(vi) resulting from a breach of the security of a system maintained or managed by the Licensor, including the costs for notification, mitigation and credit monitoring services required due to such breach;

(vii) resulting from a breach of confidentiality;

(viii) for which the Licensor is responsible pursuant to any indemnification obligations it has under this Agreement; or

(ix) under Section 8, Virus, Malicious, Mischievous or Destructive Programming.

(b) Except with respect to those damages enumerated in subsections 9(a)(i) through (ix) above, the Licensor shall not be liable for consequential, indirect, or incidental damages unless otherwise specified in the Agreement.

10. Payment.

The Agency shall make purchase and make payment through a reseller contract or another procurement document, which shall control with regard to payment amounts and provisions.

11. Termination.

(a) The Licensor may not terminate for non-payment an order issued through a reseller contract or another procurement document that controls payment.

(b) The Agency may terminate this Agreement without cause by giving the Licensor 30 calendar days’ prior written notice (“Notice of Termination”) whenever the Agency shall determine that such termination is in the best interest of the Commonwealth (“Termination for Convenience”).

12. Background Checks.

(a) Upon prior written request by the Agency, the Licensor must, at its expense, arrange for a background check for each of its employees, as well as for the employees of its subcontractors, who will have access to Commonwealth Confidential Information or Commonwealth facilities, either through on site or remote access. Background checks shall be conducted via the Request for Criminal Record Check for in-state Licensor employees or via a criminal background check through the appropriate State Agency for the out of state Licensor employees. The background check shall be conducted prior to initial access by the Licensor employee and annually thereafter.

(b) Before the Agency permits an employee access to Commonwealth Confidential Information or Commonwealth facilities, the Licensor must provide written confirmation to the office designated by the Agency that the background check has been conducted. If, at any time, it is discovered that an employee has a criminal record that includes a felony or misdemeanor involving terrorist threats, violence, use of a lethal weapon, or breach of trust or fiduciary responsibility; or which raises concerns about building, system, or personal security, or is otherwise job-related, the Licensor shall not assign that employee to any Agency facilities, shall remove any access privileges already given to the employee, and shall not permit that employee remote access to Agency facilities, systems or Confidential Information, unless the Agency consents, in writing, prior to the access being provided. The Agency may withhold its consent at its sole discretion. Failure of the Licensor to comply with the terms of this subsection may result in the default of the Licensor under its Agreement with the Agency.

(c) The Agency specifically reserves the right to conduct background checks over and above that described herein.

13. Confidentiality.

(a) Definition. “Confidential Information:”

(i) For the Agency: Information, whether oral or written or via computer disk or electronic media, to which the Licensor is given access, or which is made available by the Commonwealth, whether directly or through a third party, is defined as "Confidential Information." Confidential Information shall include, without limitation, all technology, know-how, processes, software, databases, Trade Secrets (as defined by the Pennsylvania Uniform Trade Secret Act found at 12 Pa. Cons. Stats Secs. 5392 et. seq.), proprietary information, product and business requirements, and information about or from the Commonwealth’s vendors or employees whether received before or after the Effective Date of this Agreement. Confidential Information shall also include information and documentation that is not permitted to be disclosed to third parties under local, Commonwealth or federal laws and regulations or pursuant to any policy adopted by the Agency or the Commonwealth or pursuant to the terms of any third-party agreement to which the Agency or the Commonwealth is a party. Sensitive information, as define in Section 14 below, shall be a subset of Confidential Information of the Commonwealth, and shall be subject to additional protections as set forth in Section 14 below.

(ii) For the Licensor: All information identified in writing by the Licensor as confidential or proprietary to the Licensor or its subcontractors.

(b) Confidential Information. All Confidential Information of or relating to the disclosing party shall be held in confidence by the receiving party to the same extent and in at least the same manner as the receiving party protects its own confidential or proprietary information, using no less than commercially reasonable standards or higher or more stringent standards required by law, including those laws governing Sensitive Information, and those standard specified in this Agreement. The receiving party shall not disclose, publish, release, transfer or otherwise make available any Confidential Information of the disclosing party in any form to, or for the use or benefit of, any person or entity without the disclosing party’s consent. Subject to the other provisions of this Agreement, receiving party shall be permitted to disclose relevant aspects of the disclosing party’s Confidential Information to the receiving party’s officers, agents, subcontractors and personnel and to the officers, agents, subcontractors and personnel of the receiving party’s corporate affiliates or subsidiaries to the extent that such disclosure is reasonably necessary for the performance of the receiving party’s duties and obligations under this Agreement; provided, however, that the receiving party shall take all reasonable measures to ensure that Confidential Information of the disclosing party is not disclosed or duplicated in violation of the provisions of this Agreement by such officers, agents, subcontractors and personnel and that the receiving party shall be responsible for any unauthorized disclosure of the Confidential Information by the receiving party’s officers, agents, subcontractors or personnel; and further provided, that if the disclosure is by the Agency to another contractor or sub-contractor, such disclosure is subject to a suitable non-disclosure agreement imposing equally or more stringent requirements for data privacy and security. Except for Sensitive Information (which shall be protected in all circumstances), and except to the extent provided otherwise by any applicable law, the obligations of this subsection (b) shall not apply with respect to information that:

(i) is developed by the other party without violating the disclosing party’s proprietary rights;

(ii) is or becomes publicly known;

(iii) is disclosed by the owner of such information to a third party free of any obligation of confidentiality;

(iv) is already known by the receiving party without an obligation of confidentiality other than pursuant to this Agreement or any confidentiality contract entered into before the Effective Date of the Agreement between the Agency and the Licensor; or

(v) is rightfully received by the receiving party free of any obligation of confidentiality.

(c) Obligations. Each party shall:

(i) notify the other party promptly of any known unauthorized possession, use or knowledge of the other party’s Confidential Information by any person or entity;

(ii) promptly furnish to the other party full details known by such party relating to the unauthorized possession, use or knowledge of the other party’s Confidential Information by any person or entity and use reasonable efforts to assist the other party in investigating or preventing the recurrence of any unauthorized possession, use or knowledge of the other party’s Confidential Information;

(iii) use reasonable efforts to cooperate with the other party in any litigation and investigation against third parties deemed necessary by the other party to protect the other party’s proprietary rights; and

(iv) promptly use all reasonable efforts to prevent a recurrence of any such unauthorized possession, use or knowledge of the other party’s Confidential Information.

(d) Cost of compliance; required disclosure. Each party shall bear the cost it incurs as a result of compliance with this section. The obligations in this section shall not restrict any disclosure by either party pursuant to any applicable law or pursuant to the order of any court or other legal process or government agency of competent jurisdiction (provided that the receiving party shall give prompt notice to the disclosing party of such disclosure or order in a timeframe to allow the disclosing party to resist the disclosure or order).

(e) Submitting Confidential Information to the Agency. The Licensor shall use the following process when submitting information to the Agency that it believes to be confidential and/or proprietary information or trade secrets:

(i) prepare an un-redacted version of the appropriate document;

(ii) prepare a redacted version of the document that redacts the information that is asserted to be confidential or proprietary information or a trade secret;

(iii) prepare a signed written statement that states:

(1) the attached document contains confidential or proprietary information or trade secrets;

(2) the Licensor is submitting the document in both redacted and un-redacted format in accordance with Section 707(b) of the Right-to-Know Law, 65 P.S. § 67.707(b); and

(3) the Licensor is requesting that the document be considered exempt under Section 708(b)(11) of the Right-to-Know Law, 65 P.S. § 67.708(b)(11) from public records requests; and

(iv) submit the two (2) documents with the signed written statement to the Agency.

(f) Confidential Information at Termination. Upon expiration or termination of this Agreement, or a purchase order or other procurement document for Licensed Products governed by the terms of this Agreement, and at any other time at the written request of a party, the receiving party must promptly return to the disclosing party all of the disclosing party’s Confidential Information and Data (and all copies of this information) that is in the receiving party’s possession or control, regardless of form.

(g) Not Confidential. Additionally, neither this Agreement nor any pricing information related to this Agreement, nor purchase orders issued pursuant to this Agreement, will be deemed confidential.

14. Sensitive Information.

(a) “Sensitive Information” is a subcategory of Confidential Information of the Commonwealth and shall include, regardless of whether marked or identified by the Agency as confidential:

(i) Information related to the design or implementation of the Agency’s technology and security infrastructure and architecture, including, but not limited to, Protected Critical Infrastructure Information (PCII) under the Cybersecurity Information Sharing Act (CISA) of 2015;

(ii) Information identified as Sensitive Security Information, Protected Information or Privileged Information as defined in the Commonwealth’s Data Classification Policy;

(iii) Passwords, encryption keys, and other cyber security control design information;

(iv) Consumer and citizen information;

(v) Employee information;

(vi) Information that is either nonpublic personal information or personally identifiable information, including, without limitation, names, addresses, telephone numbers, fax numbers, electronic mail addresses, web universal resource locators (URLs), Internet Protocol (IP) addresses, vehicle identifiers, account numbers, birthdates, social security numbers, individual likeness or images, fingerprint or biometric data, genetic information, demographic, information contained in, relating to or deriving from medical or personal health records, criminal justice information and records, information relating to drivers licenses or other identification cards, financial and transactional information, tax information and any other information that is deemed to be nonpublic or protected under federal and state law, regulation, order or standard including, but not limited to, the Criminal History Record Information Act, the Family Education Rights and Privacy Act (FERPA), the Health Insurance Portability and Accountability Act (HIPAA), Confidentiality of HIV-Related Information Act, the Omnibus Reconciliation Act of 1990, Real ID Act of 2005, Tax Reform Act of 1976 the Internal Revenue Code and IRS Publication 1075, the Affordable Care Act, federal and state notification laws, The Driver’s Privacy Protection Act of 1994, Title V of the Gramm-Leach-Bliley Act, Section 628 of the Fair Credit Reporting Act, Section 216 of the Fair and Accurate Credit Transactions Act, the Children's Online Privacy Protection Act, and any implementing regulations, guidelines and Commonwealth policies adopted under any of these or other related laws; and

(vii) Payment Card Industry Information (PCI).

(b) The Licensor understands that its level of access may allow or require it to view or access Sensitive Information and Confidential Information. The Licensor shall hold all Commonwealth Sensitive Information in the strictest of confidence and shall use all protective measures to protect the Sensitive Information as prescribed by law, regulation and/or Commonwealth policies and standards. In addition, the Licensor shall only permit staff located in the United States to access Sensitive Information, Confidential Information and Commonwealth systems, data and services.

(c) Sensitive Information and Confidential Information may be subject to and governed by specific state and federal laws, regulations and policies that must be followed. If applicable, prior to deployment of the Products or Services, the Licensor may be required to sign off on particular instructions, restrictions and limitations as dictated by the Agency, including, but not limited to, as necessary, HIPAA Business Associate Agreements. The Agency’s use of any sign off sheet shall create specificity in the Licensor’s obligations with respect to certain Confidential Information, and this Section and the instructions within the sign-off sheet shall not, in any way, diminish the obligations of the Licensor under this Agreement with respect to Confidential Information generally and Sensitive Information specifically. The sign-off sheet shall be signed by at least one authorized signatory for the Licensor and incorporated into this Agreement.

15. Data Breach or Loss.

(a) Compliance with Laws. The Licensor shall comply with all applicable data protection, data security, data privacy and data breach notification laws, including, but not limited to, the Breach of Personal Information Notification Act, as amended November 2, 2022, P.L. 2139, No. 151, 73 P.S. §§ 2301—2330. Further, to the extent the Licensor maintains, stores, or manages computerized data on behalf of the Commonwealth that constitutes personal information, as defined in the Breach of Personal Information Notification Act, the Licensor shall comply with the then current version of the following IT Policies (ITPs): Data Classification Policy, IT Security Incident Reporting Policy, and Encryption Policy.

(b) Control of Licensor. For Data and Confidential Information in the possession, custody, and control of the Licensor or its employees, agents, and/or subcontractors:

(i) The Licensor shall report unauthorized access, acquisition, use, release, loss, destruction or disclosure of Data or Confidential Information (“Incident”) to the Agency within one (1) hour of when the Licensor knows of or reasonably suspects such Incident, and the Licensor must immediately take all reasonable steps to mitigate any potential harm or further access, acquisition, use, release, loss, destruction or disclosure of such Data or Confidential Information.

(ii) The Licensor shall provide timely notice to all individuals that may require notice under any applicable law or regulation as a result of an Incident. The notice must be pre-approved by the Agency. At the Agency’s request, the Licensor shall, at its sole expense, provide credit monitoring services to all individuals that may be impacted by any Incident requiring notice.

(iii) The Licensor shall be solely responsible for any costs, losses, fines, or damages incurred by the Agency or Commonwealth due to Incidents, which shall be reimbursed upon invoice received from the Agency.

(iv) The Licensor shall indemnify the Agency against any third party claims arising out of an Incident.

(c) Security Breach. Licensor agrees that it shall not inform any third party of any Security Breach without first obtaining the Agency’s prior, written consent, other than to inform a complainant that the matter has been forwarded to the Agency’s legal counsel. Further, the Licensor agrees that the Agency shall have the sole right to determine: (i) whether notice of the Security Breach is to be provided to any individuals, regulators, law enforcement agencies, consumer reporting agencies or others as required by law or regulation, or otherwise in the Agency’s discretion; and (ii) the contents of such notice, whether any type or remediation may be offered to affected persons, and the nature and extent of any such remediation.

(d) Diligent Performance and Cooperation. The Licensor shall diligently perform all of the duties required in this Section in cooperation with the Agency.

(e) The requirements of this section are in addition to and not in lieu of other requirements of this Agreement and its Attachments and Exhibits having to do with data privacy and security, including but not limited to the requirement that the Licensor comply with Attachment 2, Requirements for Non-Commonwealth Hosting Applications/Services, and all applicable Commonwealth Information Technology Policies (ITPs), which can be found at: http://www.oa.pa.gov/Policies/Pages/itp.aspx.

16. Hyperlink Content. Any terms and conditions contained in any hyperlink content referenced in this Agreement (“Hyperlink Content”) shall not apply to the extent such terms and conditions are expressly prohibited by applicable law. In addition, no financial obligation of the Agency or Commonwealth to Licensor shall be affected by any change to information contained in a hyperlink, nor will any additional material obligations be placed on the Agency or Commonwealth as a result of any such changes to Hyperlink Content. Terms and conditions in the Hyperlink Content that are materially inconsistent with the Agreement are rejected, unenforceable by the Licensor, and shall not become part of this Agreement unless such terms and conditions are to the benefit of the Agency or Commonwealth.

17. Publicity/Advertisement. The Licensor must obtain written Commonwealth approval prior to mentioning the Commonwealth or the Agency in an advertisement, endorsement, or any other type of publicity. This includes the use of any trademark or logo.

18. Portability. The Agency may move a Licensed Product from machine to machine, whether physical or virtual, and to other locations, where those machines and locations are internal to the Agency or to a Commonwealth contractor, as long as such relocation and the use being made of the Licensed Product comports with the license grant and restrictions. Notwithstanding the foregoing, the Agency may move the machine or appliance provided by the Licensor upon which the Licensed Product is installed.

19. Taxes-Federal, State and Local; Interest.

(a) The Commonwealth is exempt from all excise taxes imposed by the Internal Revenue Service and has accordingly registered with the Internal Revenue Service to make tax-free purchases under registration No. 23-23740001-K. With the exception of purchases of the following items, no exemption certificates are required and none will be issued: undyed diesel fuel, tires, trucks, gas-guzzler emergency vehicles, and sports fishing equipment. The Commonwealth is also exempt from Pennsylvania sales tax, local sales tax, public transportation assistance taxes, and fees and vehicle rental tax. The Department of Revenue regulations provide that exemption certificates are not required for sales made to governmental entities and none will be issued. Nothing in this section is meant to exempt a construction contractor from the payment of any of these taxes or fees which are required to be paid with respect to the purchase, use, rental or lease of tangible personal property or taxable services used or transferred in connection with the performance of a construction contract.

(b) The only interest the Agency is authorized to pay is in accordance with Act of December 13, 1982, P.L. 1155, No. 266, as amended, 72 P. S. § 1507, (relating to Interest Penalties on Commonwealth Accounts) and accompanying regulations 4 Pa. Code §§ 2.31—2.40 (relating to Interest Penalties for Late Payments).

20. Agency Audit Responsibilities.

(a) The Agency shall maintain, and promptly provide to the Licensor upon request, accurate records regarding use of the Licensed Products by or for the Agency. If the Agency becomes aware of any unauthorized use of all or any part of the Licensed Products, the Agency shall notify the Licensor promptly, providing reasonable details. The limit of the Agency’s responsibility for use of the Licensed Products by more individuals than are permitted by the licensing terms applicable to the Licensed Products shall be to purchase additional licenses and Maintenance and Support (if applicable) for such Licensed Products through a reseller contract or another procurement document.

(b) The Agency shall perform a self-audit upon the request of the Licensor, which request may not occur more often than annually, and report any change in user count (hereinafter “True up number”). The Agency shall notify the Licensor of the True up number no later than 45 calendar days after the request that the Agency perform a self-audit. If the user count has increased, the Agency shall make an additional purchase of the Licensed Products through a reseller contract or another procurement document, which is equivalent to the additional users. This section sets out the sole software license audit right under this Agreement.

21. Right-to-Know Law. The Pennsylvania Right-to-Know Law, Act of February 14, 2008, P.L. 6, No. 3, 65 P.S. §§ 67.101—3104 (“RTKL”), applies to this Agreement.

22. Third-Party Software. If a Licensed Product utilizes or includes third party software and other copyrighted material, any additional licensing terms, acknowledgements or disclaimers associated with the third party software and materials shall not be applicable to the Agency or Commonwealth unless agreed to in writing. The parties agree that the Agency, by acknowledging third-party software, does not agree to any terms and conditions of the third-party software agreements.

23. Attorneys’ Fees. The Agency is not responsible for and shall not pay attorneys’ fees incurred by or paid by the Licensor.

24. Controversies.

(a) Pursuant to Section 1712.1 of the Commonwealth Procurement Code, 62 Pa. C.S. § 1712.1, in the event of a claim arising from the Agreement or a purchase order, the Licensor, within six (6) months after the claim accrues, must file a written claim with the contracting officer for a determination. The claim shall state all grounds upon which the Licensor asserts a controversy exists. If the Licensor fails to file a claim or files an untimely claim, the Licensor is deemed to have waived its right to assert a claim in any forum. At the time the claim is filed, or within 60 days thereafter, either party may request mediation through the Commonwealth Office of General Counsel Dispute Resolution Program, http://www.ogc.pa.gov/Services%20to%20Agencies/Mediation%20Procedures/Pages/default.aspx.

(b) If the Licensor or the contracting officer requests mediation and the other party agrees, the contracting officer shall promptly make arrangements for mediation. Mediation shall be scheduled so as to not delay the issuance of the final determination beyond the required 120 days after receipt of the claim if mediation is unsuccessful. If mediation is not agreed to or if resolution is not reached through mediation, the contracting officer shall review timely-filed claims and issue a final determination, in writing, regarding the claim. The final determination shall be issued within 120 days of the receipt of the claim, unless extended by consent of the contracting officer and the Licensor. The contracting officer shall send his/her written determination to the Licensor. If the contracting officer fails to issue a final determination within the 120 days (unless extended by consent of the parties), the claim shall be deemed denied. The contracting officer’s determination shall be the final order of the purchasing agency.

(c) Within 15 days of the mailing date of the determination denying a claim or within 135 days of filing a claim if, no extension is agreed to by the parties, whichever occurs first, the Licensor may file a statement of claim with the Commonwealth Board of Claims. Pending a final judicial resolution of a controversy or claim, the Licensor shall proceed diligently with the performance of the Agreement or purchase order in a manner consistent with the determination of the contracting officer and the Agency shall compensate the Licensor pursuant to the terms of the Agreement, purchase order or other procurement document.

25. Insurance.

(a) The Licensor shall maintain at its expense, and require its agents, contractors and subcontractors to procure and maintain, as appropriate, the following types and amounts of insurance issued by companies acceptable to the Commonwealth and authorized to conduct such business under the laws of the Commonwealth:

(i) Workers’ Compensation Insurance for all of the employees engaged in performing Services in accordance with the Worker’s Compensation Act, the Act of June 2, 1915, P.L. 736, No. 338, reenacted and amended June 21, 1939, P.L. 520, No. 281, as amended, 77 P.S.§§ 101—2708.

(ii) Commercial general liability insurance providing coverage from claims for damages for personal injury, death (including bodily injury), sickness or disease, accidental death and damage to and property of others, including loss of use resulting from any property damage which may arise from the Licensor’s operations under this Agreement, whether such operation be by the Licensor, its agent, contractor or subcontractor, or by anyone directly or indirectly employed by either. The limits of such insurance shall be in an amount not less than $500,000 per person and $2,000,000 per occurrence, personal injury and property damage combined. Such policies shall be occurrence based rather than claims-made policies and shall name the Commonwealth of Pennsylvania as an additional insured, as its interests may appear. The insurance shall not contain any endorsements or any other form designed to limit and restrict any action by the Commonwealth as an additional insured against the insurance coverages in regard to the Services performed for or supplies provided to the Agency.

(iii) Professional and Technology-Based Services Liability Insurance (insuring against damages and claim expenses as a result of claims arising from any actual or alleged wrongful acts in performing cyber and technology activities) in the amount of $2,000,000, per accident/occurrence/annual aggregate.

(iv) Technology Products Liability/Professional Liability/Errors & Omissions Insurance in the amount of $2,000,000, per accident/occurrence/annual aggregate, covering the Licensor, its employees, agents, contractors, and subcontractors in the performance of all services.

(v) Comprehensive crime insurance in an amount of not less than $5,000,000 per claim.

(vi) Information Security and Privacy Liability Insurance including Privacy Notification Costs (including coverage for Technology Professional Liability if not covered under Licensor’s Professional Liability/Errors and Omissions Insurance referenced above) in the amount of $3,000,000, per accident/occurrence/annual aggregate, covering the Licensor, its employees, agents, contractors, and subcontractors in the performance of all services.

(b) Certificate of Insurance. Prior to providing Licensed Products under this Agreement, and annually thereafter, the Licensor shall provide the Agency with a copy of each current certificate of insurance required by this section. These certificates shall contain a provision that coverages afforded under the policies will not be canceled or changed in such a way to cause the coverage to fail to comply with the requirements of this section until at least 15 days’ prior written notice has been received by the Agency. Such cancellation or change shall not relieve the Licensor of its continuing obligation to maintain insurance coverage in accordance with this section.

(c) Insurance coverage length. The Licensor shall maintain such insurance for the life of any applicable purchase order issued pursuant to the Agreement.

26. Signatures. The parties agree that: (1) a record or signature may not be denied legal effect or enforceability solely because it is in electronic form; (2) a contract may not be denied legal effect or enforceability solely because an electronic record was used in its formation; (3) if a law requires a record to be in writing, an electronic record satisfies the law; and (4) if law requires a signature, an electronic signature satisfies the law.

The fully executed Agreement may not contain ink signatures by the Agency. If this Agreement does not contain ink signatures by the Agency, the Licensor understands and agrees that the receipt of an electronically-printed Agreement with the printed name of the Agency purchasing agent constitutes a valid, binding contract with the Agency. The printed name of the purchasing agent represents the signature of that individual who is authorized to bind the Agency to the obligations contained in this Agreement. The printed name also indicates that all approvals required by Commonwealth contracting procedures have been obtained.

27. Travel. The Licensor shall not be allowed or paid travel or per diem expenses except as specifically set forth in this Agreement or Statement of Work. If not otherwise specified in the Agreement or Statement of Work, travel and related expenses shall be reimbursed in accordance with Management Directive 230.10 Amended, Commonwealth Travel Policy, and Manual 230.1, Commonwealth Travel Procedures Manual.

28. Entire Agreement. This Agreement constitutes the entire agreement between the parties pertaining to the subject matter hereof, and supersedes and integrates all prior discussions, agreements and understandings pertaining thereto. No modification of this Agreement will be effective unless in writing and signed by both Parties.

29. Notice. Any written notice to either party shall be deemed sufficient if delivered personally, or by facsimile, telecopy, electronic or digital transmission (provided such delivery is confirmed), or by a recognized overnight courier service (e.g., DHL, Federal Express, etc.), with confirmed receipt, or by certified or registered United States mail, postage prepaid, return receipt requested, sent to the address such party may designate by notice given pursuant to this section.

30. Survival. The termination or expiration of this Agreement will not affect any provisions of this Agreement which by their nature survive termination or expiration, including the provisions that deal with the following subject matters: definitions, confidentiality, term and termination, effect of termination, intellectual property, license compliance, limitation of liability, indemnification and privacy.

31. Waiver. Failure to enforce any provision will not constitute a waiver.

32. Severability. If any provision is found unenforceable, it and any related provisions will be interpreted to best accomplish the unenforceable provision’s essential purpose.

33. Nonexclusive Remedy. Except as expressly set forth in this Agreement, the exercise by either party of any of its remedies under this Agreement will be without prejudice to its other remedies under this Agreement or otherwise.

34. Integration. This Agreement, including all exhibits and referenced documents, and any Purchase Orders referencing this Agreement, constitutes the entire agreement between the parties. No agent, representative, employee or officer of the Commonwealth or of Licensor has authority to make any statement, agreement, or representation, oral or written, in connection with this Agreement, which in any way can be deemed to modify, add to, or detract from, or otherwise change or alter its terms and conditions. No negotiations between the parties, nor any custom or usage, shall be permitted to modify or contradict any of the terms and conditions of this Agreement. No modifications, alterations, changes, or waiver to this Agreement or any of its terms shall be valid or binding unless accomplished by a written amendment executed by the parties.

[Reminder of Page Intentionally Left Blank]

The parties to this Agreement have executed it, through their respective duly authorized representatives.

Witness: Licensor:

Signature Date Signature Date

Printed Name Printed Name

Title Title

If a corporation, the Chairman, President, Vice-President, Senior Vice-President, Executive Vice-President, Assistant Vice-President, Chief Executive Officer or Chief Operating Officer must sign; if a sole proprietor, then the owner must sign; if a general or limited partnership, a general partner must sign; if a limited liability company, then a member must sign, unless it is a managed by a manager, then the manager must sign; otherwise a resolution indicating authority to bind the corporation must be attached to this Agreement.

COMMONWEALTH OF PENNSYLVANIA

XXXXXXXXXXXXXXXXX

Agency Head or Designee

APPROVED AS TO FORM AND LEGALITY:

Electronically Signed See Section 26 Office of Attorney General

APPROVED:

Electronically Signed See Section 26 Comptroller

ATTACHMENT 1

LIST OF LICENSED PRODUCTS

With the consent of the Agency, additional Licensed Products may be added to this attachment by the Licensor providing the Agency with a new copy of this Attachment 1.

Licensed Products:

The Licensed Products include (list all titles covered by this Agreement):

Revised January 23, 2025

ATTACHMENT 2

Requirements for Non-Commonwealth Hosted Applications and/or Services

The purpose of this Attachment is to define requirements for business or technology solutions and services procured by the Commonwealth that are hosted within the Service Organization (Licensor’s) or its Subservice Organization(s) (subcontractors) managed infrastructure. Any reference to Licensor below applies to Licensor and its subcontractors.

A. Hosting Requirements

1. The Licensor shall supply and maintain all hosting equipment (hardware and software) required for the delivery of the computing services.

2. The Licensor shall provide secure access to users leveraging the principle of least privilege and delegating administration to the Commonwealth where possible.

3. The Licensor shall use commercially reasonable resources and efforts to maintain adequate network bandwidth and server capacity to meet expected service levels.

4. The Licensor shall maintain all components of the Licensor hosted solution with commercially reasonable support and replace as necessary to maintain compliance.

5. The Licensor shall monitor, prevent, and deter unauthorized system access. The Licensor shall use all commercially reasonable methods to confirm suspected breaches. In the event of any impermissible disclosure, unauthorized loss or destruction of Confidential Information, the receiving Party must immediately notify the disclosing Party and take all reasonable steps to mitigate any potential harm or further disclosure of such Confidential Information. The Licensor shall provide the Commonwealth with any requested logs, reports, and other information concerning unauthorized access or disclosure of Commonwealth data, including any mitigation efforts by Licensor. Any such information provided by Licensor shall be treated as confidential.