DOC1676297463.pdf

Procure-to-Pay

3835 Holdrege Street | Lincoln, NE 68583-0742 | 402.472.2126 nebraska.edu/p2p

University of Nebraska Contract Summary

CONTRACTOR/COMPANY INFORMATION

Supplier Arrow Stage Lines Contact Alex Busskohl

Sourcing Agent Mike Hendrickson Email alex.busskohl@arrowstageline s.com

REQUESTING DEPARTMENT

Participating Campuses

UNO

Administrative Unit/Dept.

Parking and Transit

Department Contact Dave Peterson

CONTRACT DESCRIPTION/INFORMATION

Contract Summary (brief description and/ or event name)

This is the shuttle service for students to move between Scott and Dodge campus at University of Nebraska at Omaha. We are asking general counsel to write an amendment to the existing agreement for a one-year extension, at the rate of

98.00 for the term 8-15-25 to 8-14-26 First 3 years of the contract expire 8-14-25.

Contract Document Document Amt Total Amt Start Date End Date Notes

5 year contract Amendment 8/2025

$7.3 million 8/15/2022 8/14/2027

COMPETITION/BID INFORMATION

Bid Number 3558-22-7811

Competition

Contract Information

Reviewed and amended by General Counsel

INTERNAL USE ONLY

CW32149

University of Nebraska Amendment No. 1 to University of Nebraska Master Agreement

This Amendment No. 1 to University of Nebraska Master Agreement (“Amendment”) is effective as of the date of the last signature set forth below (“Effective Date”) by and between the Board of Regents of the University of Nebraska, a public body corporate and governing body of the University of Nebraska (“University”), which is composed of a chief governing administrative unit (University of Nebraska System), four universities (University of Nebraska at Kearney, University of Nebraska-Lincoln, University of Nebraska Medical Center, and University of Nebraska at Omaha), and such other institutions and units as may be designated by the Nebraska Legislature, and Busco, Inc. d/b/a Arrow Stage Lines (“Service Provider”).

RECITALS

A. University and Service Provider entered into a University of Nebraska Master Agreement effective as of August 16, 2022 (“Agreement”).

B. The parties desire to amend the Agreement.

AGREEMENT

NOW THEREFORE, in consideration of the mutual covenants contained in the Agreement and this Amendment, the parties agree as follows:

1. Ratification. Except as expressly provided in this Amendment, all of the terms and provisions of the Agreement shall remain in full force and effect and are hereby ratified and confirmed by the parties.

2. Definitions. Capitalized terms used and not defined in this Amendment have the respective meanings assigned to them in the Agreement.

3. Modifications. The Agreement is amended as follows:

a. Delete section 18 in its entirety and replace it with the following:

Debarment List. Service Provider certifies and warrants that it has not been debarred, suspended, or declared ineligible as defined in the Federal Acquisition Regulation 48 CFR Ch.1 Subpart 9.4.

Service Provider also certifies that Service Provider, its partners, directors, officers, employees, licensees, subcontractors, or agents have not been excluded or debarred or otherwise become ineligible to participate in federal health care programs pursuant to 42 USC § 1320a-7. The certification and warranty set forth in this section shall be an ongoing certification and warranty during the Term, and Service Provider shall immediately notify University of any change in the status of the certification and warranty set forth in this section. If Service Provider becomes excluded from federal health care program participation or placed on the Consolidated List of Debarred, Suspended, and Ineligible Contractors, this Agreement may be terminated immediately, for cause, by University. If any partners, directors, officers, employees, licensees, subcontractors, personnel, or agents of Service Provider become excluded from federal health care program participation, such individual shall be removed from participating in this Agreement immediately.

Failure by Service Provider to remove such excluded individual immediately shall provide University the right to terminate this Agreement immediately for cause.

b. Delete section 20 in its entirety and replace it with the following:

Taxpayer Transparency Act. Under Neb. Rev. Stat. §§ 84-602.01 to 84-602.04, University is required to provide the Nebraska Department of Administrative Services with a copy of each contract that is a basis for an expenditure of state funds, including any amendments and documents incorporated by reference in the contract. Copies of all such contracts and documents will be published by the Nebraska Department of Administrative Services at https://statecontracts.nebraska.gov/. It shall be the sole responsibility of Service Provider (a) to https://statecontracts.nebraska.gov/ notify University of any requested redactions to this Agreement, any amendment to this Agreement, and any document incorporated by reference into this Agreement and (b) to indicate the legal basis for such requested redactions at the time of execution thereof. In addition, Service Provider shall defend any challenge to such redactions at its own expense. Service Provider’s failure to request redactions to any contracts or documents released by University under this section shall constitute a complete waiver of any and all claims for damages caused by any such release.

c. Delete section 21 in its entirety and replace it with the following:

Federal Funding Compliance. If this Agreement involves federal funds, (a) Service Provider’s compliance in all respects with all applicable federal anti-discrimination laws is material to Service

Provider’s performance under this Agreement; (b) Service Provider certifies that it does not operate any programs promoting diversity, equity, and inclusion that violate such laws; and (c) Service

Provider’s failure to comply with such laws shall be considered a material breach of this Agreement.

If this Agreement is for $15,000 or more and involves federal funds, then Service Provider shall comply with 41 CFR §§ 60-300.5(a) and 60-741.5(a), which are incorporated herein by this reference. These regulations prohibit discrimination against qualified individuals based on their status as protected veterans or individuals with disabilities and require action to employ and advance in employment individuals without regard to disability or veteran status.

If Service Provider has fifty (50) or more employees and this Agreement involves payment of $50,000 or more in federal funds to Service Provider, then Service Provider shall develop or maintain a program as described in 41 CFR 60‐741, subpart C. If Service Provider has fifty (50) or more employees and this Agreement involves payment of $150,000 or more in federal funds to Service Provider, then Service Provider shall develop or maintain a program as described in 41 CFR 60‐300, subpart C. To the extent any of the provisions of Appendix II to 2 CFR Part 200 apply to this Agreement, such provisions are incorporated herein by this reference and apply to Service Provider as a “contractor,” “recipient,” or “subrecipient.”

d. Add the following as a new section 29:

Discrimination including Sexual Harassment. State and federal law, as well as University of

Nebraska Bylaws, policies, and guidelines prohibit discrimination (as defined therein) including harassment and retaliation, against students, employees, and other members of University community. Prohibited types of discrimination include discrimination on the basis of race, color, ethnicity, national origin, sex (including sexual harassment), pregnancy, sexual orientation, gender identity, religion, disability, age, genetic information, veteran status, marital status, political affiliation, and any other protected status. Service Provider shall exercise control over itself, its employees, agents, contractors, and affiliated parties to prohibit acts of discrimination, including sexual harassment, against University students, employees, and other members of the University community. Service Provider shall cooperate with University following any report of discrimination.

In the event University determines that Service Provider or an employee, agent, contractor, or other person affiliated with Service Provider has engaged in discrimination, including harassment, or other inappropriate conduct, Service Provider will take prompt and effective action, in accordance with University’s direction, to prevent recurrence of the conduct and to correct its effects, which may include removal of Service Provider or the employee, agent, contractor, or other person affiliated with Service Provider from providing the Services. Service Provider’s failure to comply with University’s directive or any other part of this provision may be cause for immediate termination of this Agreement. Service Provider acknowledges that University may have obligations to report any allegations or incidents of discrimination, including sexual harassment. Service Provider and employees, agents, contractors, and other persons affiliated with Service Provider who are directly providing the Services or present on University premises shall participate in any training as may be required by University from time to time, including training regarding sexual harassment.

e. Add the following as a new section 30:

Public Records. Under Neb. Rev. Stat. §§ 84-712 to 84-712.09, information or records of or belonging to University regarding, related to, or part of this Agreement will be open to public inspection and copying unless exempted from disclosure in accordance with University’s interpretation and application of applicable law. It shall be the sole responsibility of Service Provider

(a) to notify University of requested redactions to any such information or records that may otherwise be required to be open to public inspection and copying and (b) to indicate the legal basis for such requested redactions. In addition, Service Provider shall defend any challenge to such requested redactions at its own expense. Service Provider’s failure to request redactions to any information or records released by University under this section shall constitute a complete waiver of any and all claims for damages caused by any such release

f. Add the following as a new section 31:

Service Provider App. Service Provider shall provide University with an application program, to be used by University, University students, and others, in connection with the Services that can be accessed and used as both a mobile application and a website application (“App”) that is available for download through all major online application stores, including but not limited to the Google Play

Store and Apple App Store. The App must comply with and conform to the App requirements set forth in Exhibit B to this Agreement.

g. Add the following as a new section 32:

Requirements for Service Provider and App Provider. If Service Provider procures the App from a third-party (“App Provider”), Service Provider shall enter into a written agreement with App

Provider regarding the provision of the App for the benefit of University in connection with the

Services and this Agreement (“App Agreement”). The App Agreement shall, at a minimum, comply with the requirements for the App set forth in this Agreement, and Service Provider shall require

App Provider to be bound by and comply with the terms of Exhibit B to this Agreement, Exhibit C to this Agreement, and Exhibit D to this Agreement as if App Provider were Service Provider. Any term in Exhibits B, and/or C that, by its context, may be construed to apply to the App Agreement shall apply to the relationship between Service Provider and App Provider such that the term

“Service Provider” shall be construed to mean App Provider, the term “University” shall be construed to mean Service Provider, and the term “Agreement” shall be construed to mean the App

Agreement in whatever form it takes between Service Provider and App Provider. Any term in

Exhibit D that, by its context, may be construed to apply to the App Agreement shall apply to App

Provider such that the term “Service Provider” shall be construed to mean App Provider, and the term “Agreement” shall be construed to mean the App Agreement, in whatever form it takes.

4. Additional Exhibits to the Agreement. The document attached to this Amendment as Exhibit B shall be attached to and incorporated into the Agreement as Exhibit B. The document attached this

Amendment as Exhibit C shall be attached to and incorporated into the Agreement as Exhibit C. The document attached this Amendment as Exhibit D shall be attached to and incorporated into the Agreement as Exhibit D.

5. Renewal and Pricing. University and Service Provider hereby renew and extend the duration of the Agreement for an additional year such that the Agreement, as amended herein, and unless sooner terminated in accordance with the provisions of the Agreement, shall expire at 11:59 p.m. on August 15, 2026. For the time period August 16, 2025 through August 15, 2026, University shall provide payment to

Service Provider for provision of the Services at the rate of $98 per hour with this amount including all compensation due to Service provider, including but not limited to compensation for the App, ride systems, wheelchair lifts, bike racks, WI-FI, etc. The only variable cost to be charged by Service Provider in addition to the $98 per hour rate is the fuel surcharge, list in Service Provider’s Bid Response attached to the

Agreement.

6. Entire Agreement. The Agreement, as amended, constitutes the entire agreement between the parties and supersedes all prior and contemporaneous understandings, agreements, representations, and warranties, both written and oral.

7. Amendment. No change, modification, or waiver of any term of the Agreement shall be valid unless it is in writing and signed by both parties.

IN WITNESS WHEREOF, the parties have entered into this Amendment as of the date set forth below.

Board of Regents of the University of Nebraska

Signature:

Printed Name:

Date:

Title:

Service Provider

Signature:

Printed Name:

Date:

Title:

08/07/25 | 09:06 CDT

VP of Sales/Business Development

Alex BusskohlAnne Barnes

08/10/25 | 11:16 CDT

Senior VP & CFO

EXHIBIT B

The App provided by Service Provider must comply with and conform to the following:

• Be a cloud-based web application

• Use a centralized operations management software

• Have automated transit operations processes and information including, but not limited to, providing for all Service Provider vehicles:

o Live vehicle global positioning system (“GPS”) location, vehicle identification, identification of the route that the vehicle is traveling on, vehicle speed, and information sufficient to determine schedule adherence o Real-time traffic overlay via Google Traffic o Data pertaining to vehicle “on-time” performance as to allow University to determine which vehicles are staying on schedule

• Allow University to manage transit data including but not limited to:

o Allowing University to set up and manage Service Provider vehicle routes through the creation and editing of route shapes, as well as allowing University to choose the arrival time calculation method and vehicle schedule o Manage all Service Provider vehicle stops on graphical map interface that provides Service Provider vehicle name, GPS coordinates, and identification of the route that the vehicle is traveling on o For all Service Provider vehicles, allow University to view:

▪ Vehicle and driver assignment

▪ Vehicle scheduling

• Provide real-time service monitoring and historical reporting for Service Provider vehicles with the ability to generate at least the following reports:

o Reports generated in CSV format that list for each for Service Provider vehicle:

▪ “On-time” performance

▪ Service frequency

▪ Passenger count by hour

▪ Passenger count average

▪ Logged driver time

▪ Average speed by route and hour o Reports that are viewable online or in a website format that show and depict:

▪ Historical vehicle map playback for investigating incidents

▪ Ridership charting of passenger counts by hour

• Reliable performance of all components and aspects of the App

• General Transit Feed Specification (GTFS) standards-compliant data for universal accessibility

• User-friendly interface, as determined in University’s sole discretion

• iOS and Android platforms for App

• Incorporate and use white-labelling to align with University branding to the extent requested by University, at the University’s sole discretion

• Allow users to view Service Provider vehicle location, stops, and arrival times

• Allow users to set up notification alarms and view news, alerts, and service changes

• User-friendly interface, as determined by University in its sole discretion, for all users that is accessible from any modern web browser

• User-friendly interface, as determined by University in its sole discretion, for University back-office/administration that is accessible from any modern web browser

• Responsive customer and technical assistance

EXHIBIT C

University of Nebraska Data Security Addendum

This University of Nebraska Data Security Addendum (the “Addendum”) to the University of Nebraska Master Agreement dated August 16, 2022 (the “Agreement”) is effective as of the date of the last signature set forth below between the Board of Regents of the University of Nebraska a public body corporate and governing body of the University of Nebraska (“University”), which is composed of a chief governing administrative unit (University of Nebraska System), four universities (University of Nebraska at Kearney, University of Nebraska-Lincoln, University of Nebraska Medical Center, and University of Nebraska at Omaha), and such other institutions and units as may be designated by the Nebraska Legislature, and Busco, Inc. d/b/a Arrow Stage Lines (“Service Provider”).

RECITALS

A. Under the Agreement, Service Provider will access or use CDI (as defined below).

B. University and Service Provider desire to supplement the Agreement as set forth in this Addendum to protect CDI accessed or used by Service Provider.

AGREEMENT

NOW, THEREFORE, in consideration of the mutual covenants set forth in the Agreement and herein and the above recitals, which are incorporated herein by this reference, the parties agree as follows:

1. Incorporation and Priority of Terms. The Agreement is amended as stated herein and this Addendum is incorporated into the Agreement by this reference. In the event of a conflict between the terms of this Addendum and the Agreement, the terms of this Addendum shall prevail.

2. Definitions. The following terms shall have the following meanings when used in this Addendum:

a. “Anonymize” means removal of Personal Information and any information reasonably likely to identify a company or other business entity; provided such revised data does not include and is not subject to any key.

b. Covered Data and Information or “CDI” includes paper and electronic education record information;

Student Financial Information required to be protected under the Gramm-Leach-Bliley Act (“GLBA”) and any credit card information received in the course of business by University, whether or not such credit card information is covered by GLBA; data provided by University's students to Service Provider, if any; and any and all paper and electronic Personal Information, financial information, corporate business intelligence, or intellectual property of University or University’s employees.

c. “Offering a Financial Product or Service” includes offering student loans to students, receiving income tax information from a student's parent when offering a financial aid package, and other miscellaneous financial services as defined in 12 CFR § 225.28.

d. “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, could reasonably be used to infer information about, or could reasonably be linked, directly or indirectly, with an individual person or household.

e. “Student Financial Information” means information that University has obtained from a student in the process of Offering a Financial Product or Service or such information provided to University by a financial institution. Examples of Student Financial Information include addresses, phone numbers, bank and credit card account numbers, income and credit histories, and Social Security numbers in both paper and electronic format.

3. CDI Ownership and License. As between University and Service Provider, University possesses and retains all right, title, and interest in and to CDI, and Service Provider’s use and possession thereof is solely on University’s behalf. University hereby grants Service Provider a limited license to reproduce and otherwise manage CDI during the term of the Agreement solely as specifically authorized in this Addendum.

Service Provider has no property interest in, and may assert no lien on or right to withhold from University, any data Service Provider receives from, receives addressed to, or stores on behalf of University.

4. Use and Disclosure of CDI. Service Provider shall comply with all applicable laws and regulations governing Service Provider’s access to, use of, and handling of CDI. Service Provider shall abide by (a) the direction of University with respect to the use and maintenance of education records and (b) the limitations on re-disclosure of personally identifiable information from education records set forth in the Family Educational Rights and Privacy Act. Service Provider shall not use any education record for any purpose other than the purpose for which the disclosure of the education record was made. Service Provider shall also comply with the requirements of GLBA dealing with the confidentiality of customer information and the Safeguards Rule if applicable. Without limiting the generality of Service Provider’s obligations elsewhere in this Addendum, Service Provider shall protect all CDI in accordance with generally accepted information security standards and best practices and exercise commercially reasonable efforts to prevent unauthorized exposure or disclosure of CDI.

Service Provider may access and use CDI solely as permitted or required by the Agreement, and, unless it receives University’s prior written consent, Service Provider shall not (i) access or use CDI for any purpose other than as permitted or required by the Agreement or (ii) give any third party access to CDI, except subcontractors subject to section 13 (Employees and Subcontractors) of this Addendum. Notwithstanding the provisions above of this section, Service Provider may disclose CDI as required by applicable law or by proper legal or governmental authority. Service Provider shall give University prompt notice of any such legal or governmental demand and reasonably cooperate with University in any effort to seek a protective order or otherwise to contest such required disclosure, at University’s expense. No revision of Service Provider’s privacy policy will alter University’s rights and remedies in this Addendum.

5. Aggregate/Anonymized Data. Notwithstanding section 4 (Use and Disclosure of CDI), University hereby authorizes Service Provider: (a) to Anonymize CDI and to combine it with data from other customers into a new aggregate dataset; and (b) to use such Anonymized CDI as a component of such new aggregate dataset for any legal business purpose, including without limitation for distribution to third parties. Without limiting the generality of the requirements for Anonymized data below, Service Provider shall (i) implement technical safeguards that prohibit reversal of Anonymization of CDI; (ii) implement business processes that specifically prohibit such reversal or recreation; (iii) make no attempt to achieve such reversal; and (iv) implement reasonable business processes to prevent inadvertent release of Anonymized CDI.

6. Injunction and Enforcement. Service Provider agrees that (a) no adequate remedy exists at law if it fails to perform or breaches any of its obligations in this Addendum; (b) it would be difficult to determine the damages resulting from its breach of this Addendum, and such breach would cause irreparable harm to University; and (c) a grant of injunctive relief provides the best remedy for any such breach, without any requirement that University prove actual damage or post a bond or other security. Service Provider waives any opposition to such injunctive relief or any right to such proof, bond, or other security. Service Provider’s obligations in this Addendum (without limitation) apply likewise to Service Provider’s successors, including without limitation to any trustee in bankruptcy. (This section does not limit either party’s right to injunctive relief from breaches not listed.)

7. Legal Requests. If Service Provider is served with a warrant, subpoena, or any other order or request (“Legal Request”) from a government body or any other person for any CDI, Service Provider will, as soon as reasonably practical and not in violation of law, deliver to University a copy of such Legal Request and will not, without University’s prior written consent, comply with the Legal Request unless and until required to do so under applicable law.

8. Approved Region and Data Centers. Service Provider shall not transfer CDI (or allow its subcontractors to transfer CDI) outside the United States unless it receives University’s prior written consent.

9. University Access. University may access and copy any CDI in Service Provider’s possession at any time. Service Provider shall reasonably facilitate such access and copying promptly after University’s request, provided Service Provider may charge its reasonable then-standard fees for any such access and copying or for any related deconversion of data.

10. Deletion. Except as required by applicable law, Service Provider shall not erase CDI or any copy thereof without University’s prior written consent. Further, Service Provider shall (a) halt CDI deletion promptly if University informs Service Provider that any CDI is subject to electronic discovery or otherwise relevant to potential litigation; (b) at such times as University may request (including without limitation as a result of requests made mandatory by applicable law), promptly erase all CDI from all systems under Service Provider’s control and direct and ensure erasure by any and all of its subcontractors that have access to CDI; and (c) within thirty (30) days of termination (including without limitation expiration) of the Agreement, erase all CDI in Service Provider’s possession or control, including without limitation in the possession or control of its subcontractors, subject to Service Provider’s rights above (if any) in section 5 (Aggregate/Anonymized Data) of this Addendum. In erasing CDI as required by the Agreement, Service Provider shall leave no data readable, decipherable, or recoverable on its computers or other media or those of its subcontractors, using the best erasure methods commercially feasible. Promptly after any erasure of CDI or any part of it, Service Provider shall certify such erasure to University in writing.

11. Remedies. If University reasonably determines in good faith that Service Provider has materially breached any of its obligations under this Addendum, then University, in its sole discretion, shall have the right to (a) require Service Provider to submit to a plan of monitoring and reporting, (b) provide Service Provider with a fifteen (15) day period to cure the breach, or (c) terminate the Agreement immediately if cure is not possible. Before exercising any of these options, University shall provide written notice to Service Provider describing the violation and the action it intends to take.

12. InfoSec Program. Service Provider shall maintain, implement, and comply with a written data and information security program (the “InfoSec Program”) that requires administrative, technical, and physical safeguards appropriate to the nature of the CDI disclosed and reasonably designed (a) to protect the security and confidentiality of CDI; (b) to protect against anticipated threats or hazards to the security or integrity of CDI; and (c) to protect against unauthorized access to and acquisition, destruction, use, modification, or disclosure of CDI. Service Provider shall likewise ensure that the InfoSec Program includes and requires compliance with the following (without limitation): (d) guidelines on the proper disposal of CDI after it is no longer needed to carry out the purposes of the Agreement, consistent with the requirements section 10 (Deletion) of this Addendum; (e) access controls on electronic systems used to maintain, access, or transmit CDI; (f) access restrictions at physical locations containing CDI; (g) encryption of electronic CDI consistent with then-current nationally recognized encryption standards; (h) least privilege principles for access to CDI, supplemented either by dual control procedures or segregation of duties; (i) regular testing and monitoring of electronic systems accessing or storing CDI; and (j) procedures to detect actual and attempted attacks on or intrusions into the systems containing or accessing CDI. Service Provider shall review the InfoSec Program and all other CDI security precautions regularly, but no less than annually, and update them to comply with applicable laws, regulations, technology changes, and best practices.

13. Employees and Subcontractors. Service Provider shall not permit any of its employees, subcontractors, or subcontractor employees to access CDI except to the extent that such individual or company needs access as permitted or required by the Agreement and is subject to a reasonable written agreement with Service Provider, or in case of employees, a reasonable written employment policy protecting such data, with terms consistent with those of this Addendum. Further, Service Provider shall not allow any individual to access CDI except to the extent that he or she has received a clean report with regard to each of the following:

a. Verifications of education and work history;

b. A seven (7)-year all residence criminal offender record information check; and

c. A seven (7)-year federal criminal offender record information check. (A clean report refers to a report with no discrepancies in education or work history and no criminal investigations or convictions related to felonies or to crimes involving identity theft or other misuse of sensitive information.)

However, subsections 13(b) and 13(c) do not apply to the extent that applicable law forbids the required record information check, provided Service Provider notifies University of such restriction. Without limiting the generality of Service Provider’s obligations related to subcontractors and their employees, Service Provider shall exercise reasonable efforts to ensure that each subcontractor complies with the terms of the Agreement related to CDI. As between Service Provider and University, Service Provider shall pay any fees or costs related to each subcontractor’s compliance with such terms.

14. Data Incidents. Service Provider shall implement and maintain a program for managing unauthorized disclosure of, access to, or use of CDI (a “Data Incident”). In case of a Data Incident, or if Service Provider suspects a Data Incident, Service Provider shall (a) promptly, and in any case within forty-eight (48) hours, notify University by telephone, in person, or by other real-time, in-person communication;

(b) cooperate with University and law enforcement agencies, where applicable, to investigate and resolve the Data Incident, including without limitation by providing reasonable assistance to University in notifying injured third parties; (c) otherwise comply with applicable laws governing data breach notification and response, including Neb. Rev. Stat. §§ 87-801 through 87-808; and (d) provide a report to University that identifies (i) the nature of the Data Incident, (ii) the CDI accessed, used, or disclosed, (iii) the identity of the individual or entity that received, accessed ,or used the CDI, and (iv) the action(s) Service Provider has taken or shall take to mitigate any potentially negative effects of the Data Incident. In addition, if the Data Incident results from Service Provider’s breach of the Agreement or negligent or unauthorized act or omission, including without limitation those of its subcontractors or other agents, Service Provider shall pay or compensate University for any reasonable expense related to (A) providing notice to affected individuals or (B) providing one (1) year of credit monitoring service to any affected individual. Service Provider shall give University prompt access to such records related to a Data Incident as University may reasonably request, and such records will be Service Provider’s confidential information pursuant to the confidentiality provisions of the Agreement; provided Service Provider is not required to give University access to records that might compromise the security of Service Provider’s other customers. This section does not limit University’s other rights or remedies, if any, resulting from a Data Incident.

15. Compliance with Red Flags Rule. The Federal Trade Commission has promulgated at 16 CFR § 681 regulations collectively known as the "Red Flags Rule" with which University must comply. Under the Red Flags Rule, University must ensure that Service Provider either complies with University's identity theft program or that Service Provider has its own policies and procedures in place to detect and respond to identity theft any pattern, practice, or specific activity that indicates the possible existence of identity theft (“Red Flag”). Service Provider represents and warrants that it has reasonable policies and procedures in place to detect, prevent, and mitigate identity theft. Service Provider shall review and comply with all relevant portions of University's identity theft policy and any applicable institutional identity theft plan.

Service Provider shall report any Red Flag that it detects in connection with the Agreement to University.

16. Cyber Insurance. Service Provider shall purchase and maintain throughout the term of the Agreement a technology or professional liability insurance policy with no cyber terrorism exclusion and a minimum limit of $10,000,000 each and every claim and in the aggregate. Such policy shall include coverage for network security or data protection liability (also called “cyber liability”) and cover liabilities for financial loss resulting or arising from acts, errors, or omissions in rendering technology or professional services or in connection with the specific services described in violation or infringement of any right of privacy, including the following: breach of security and breach of security or privacy laws, rules, or regulations globally, now or hereinafter constituted or amended; data theft, damage, unauthorized disclosure, destruction, or corruption, including without limitation unauthorized access, unauthorized use, identity theft, theft of personally identifiable information or confidential corporate information in whatever form, transmission of a computer virus or other type of malicious code, and participation in a denial of service attack on third party computer systems; ransomware attacks; and loss or denial of service. Such policy must include technology or professional liability including breach of contract, privacy and security liability, privacy regulatory defense and payment of civil fines, payment of credit card provider penalties, and breach response costs (including without limitation, notification costs, forensics, credit protection services, call center services, identity theft protection services, crisis management services, and public relations services).

Such policy must explicitly address all of the foregoing without limitation if caused by an employee of Service Provider or an independent contractor working on behalf of Service Provider in performing services under the Agreement. The policy must provide coverage for wrongful acts, claims, and lawsuits anywhere in the world. Such policy must include affirmative contractual liability coverage for the data breach indemnity in the Agreement for all damages, defense costs, privacy regulatory civil fines and penalties, and reasonable and necessary data breach notification, forensics, credit protection services, public relations, crisis management, and other data breach mitigation services resulting from a breach of confidentiality or security by or on behalf of Service Provider.

17. University Testing. If requested by University, Service Provider shall, on a quarterly basis (a) permit security reviews by University on systems storing or processing CDI and on Service Provider policies and procedures relating to the foregoing, including without limitation the InfoSec Program and (b) permit testing of all security processes and procedures during the term of the Agreement, including without limitation penetration tests. Notwithstanding the foregoing, Service Provider is not required to permit any review or inspection that may compromise the security of Service Provider’s other customers’ data.

18. Information Security Audits. Service Provider shall, prior to the effective date of the Agreement and annually thereafter (as well as promptly after any Data Incident), retain an independent certified public accounting firm to conduct an audit of data protection features related to Service Provider’s information technology system and provide a Service Organization Controls (“SOC”) 2 Type II report. Such audit shall be conducted at Service Provider’s expense and in accordance with the then-current standards of the American Institute of Certified Public Accountants (the “AICPA”). If the AICPA revises its relevant reporting standards, Service Provider shall retain such accounting firm to provide the report that then most resembles a SOC 2 Type II report. In addition, Service Provider shall annually conduct its own internal security audit and address security gaps. Service Provider shall provide University with a copy of the most current report from each audit listed above in this section within thirty (30) calendar days of University’s request. Any report or other result generated through the tests or audits required by this section or section 17 (University Testing) will be Service Provider’s confidential information pursuant to the confidentiality provisions of the Agreement. If exceptions are noted in the audit, Service Provider shall document a plan to promptly address such exceptions, including without limitation by revising the InfoSec Program, and will implement corrective measures within a reasonable period. Service Provider will provide a copy or summary of the exception remediation plan within thirty (30) days of University’s request and keep University informed of progress and completion of corrective measures. To the extent the reports provided to University under this section do not satisfy University’s reporting or audit requirements, University may conduct its own audits at its expense.

19. Indemnification. Service Provider shall indemnify, defend, and hold harmless University from any loss, liability, damage, claims, costs, or judgments University incurs, including University's costs and attorney fees, which arise from Service Provider's failure to meet any of its obligations under the Agreement, including but not limited to this Addendum.

20. Notice. Any notice required or permitted to be given under this Addendum shall be in writing, sent via certified mail or hand delivery, effective when received, and delivered to the addresses provided on the signature page of this Addendum. Notice provided under section 14 (Data Incidents) shall also be given to the email addresses and phone numbers provided on the signature page of this Addendum.

[Signature page to follow]

IN WITNESS WHEREOF, the parties have entered into this Addendum as of the date set forth below.

Signature:

Printed Name:

Date:

Title:

Service Provider

Signature:

Printed Name:

Notices to University shall be sent to:

[Name][Department] [Address] [City, State, Zip] 402-472-5700 its-sec@nebraska.edu

Notices to Service Provider shall be sent to:

Alex Busskohl 4220 South 52nd Street Omaha, NE 68117 alex.busskohl@arrowstagelines.com 402.738.3211

With copy to:

Legal Notices C/O P2P Procurement Contracts 1700 Y Street, BSC 125 Lincoln, NE 68588-0645

With copy to (optional):

VP of Sales/Business DevelopmentSenior VP & CFO

Anne Barnes

EXHIBIT D

University of Nebraska Terms of Use and Privacy Policy Compliance Addendum This University of Nebraska Terms of Use and Privacy Policy Compliance Addendum (the “Addendum”) is effective as of the date of the last signature set forth below between the Board of Regents of the University of Nebraska, a public body corporate and governing body of the University of Nebraska (“University”), which is composed of a chief governing administrative unit (University of Nebraska System), four universities (University of Nebraska at Kearney, University of Nebraska-Lincoln, University of Nebraska Medical Center, and University of Nebraska at Omaha), and such other institutions and units as may be designated by the Nebraska Legislature, and Busco, Inc. d/b/a Arrow Stage Lines (“Service Provider”).

RECITALS

A. Certain provisions of Service Provider’s “Terms of Service,” “Terms of Use,” “Privacy Policy,” and/or other similar terms for its website and/or application program (“Ancillary Terms”) cannot be accepted or are required by University as a matter of law and policy of the State of Nebraska and University.

B. The terms set forth in this Addendum are agreeable to Service Provider and Service Provider’s

Ancillary Terms are amended as stated in this Addendum.

AGREEMENT

NOW, THEREFORE, in consideration of the mutual covenants and herein and the above recitals, which are incorporated herein by this reference, the parties agree as follows:

1. Incorporation and Priority of Terms. As applied to any University employee acting in the scope and course of their employment, Service Provider’s Ancillary Terms are amended as stated herein and this

Addendum is incorporated into the Ancillary Terms by this reference. In the event of a conflict between the terms of this Addendum and the Ancillary Terms, the terms of this Addendum shall prevail.

2. Governing Law and Forum. The Ancillary Terms shall be governed by the laws of the State of

Nebraska without giving effect to its conflicts of law provisions. Any legal actions brought by either party hereunder shall be in the state courts located in Lancaster County, Nebraska. Any legal action by Service

Provider in relation to the Ancillary Terms shall be instituted in accordance with the provisions of the

Nebraska State Contract Claims Act (Neb. Rev. Stat. §§ 81-8,302 to 81-8,306).

3. No Personal Liability. In no event shall any regent, official, officer, employee, agent, or student of

University be personally liable or responsible for any representation, statement, covenant, warranty, or obligation contained in, or made in connection with, the Ancillary Terms, express or implied.

4. Unenforceability of Certain Terms. For the purposes of this section, “University” expressly includes any University employee acting in the course and scope of employment. Notwithstanding any provision of the Ancillary Terms to the contrary, any of the following terms within the Ancillary Terms shall have no effect and shall not be enforceable by Service Provider:

a. Any term requiring or stating that the terms of the Ancillary Terms shall prevail over the terms of this Addendum in the event of conflict;

b. Any term requiring University to indemnify or to hold harmless Service Provider or any third party for any act or omission;

c. Any term imposing interest charges contrary to those allowed by Neb. Rev. Stat. § 81-2404;

d. Any term requiring the application of the law of any state other than the State of Nebraska in interpreting or enforcing the Ancillary Terms or requiring or permitting that any dispute under the Ancillary

Terms be resolved in courts other than the courts of the State of Nebraska;

e. Any term limiting the time period within which claims can be made or actions can be brought;

f. Any term waiving the sovereign immunity of the State of Nebraska;

g. Any term limiting Service Provider’s or any third party’s liability for damages to University for any cause whatsoever related to: (i) intellectual property indemnity required by the Ancillary Terms; (ii) liquidated damages assessed under the Ancillary Terms; (iii) claims for personal injury, including death; (iv) claims for damage to real property or tangible or intangible property arising from Service Provider’s acts or omissions under the Ancillary Terms; (v) any loss or claim to the extent the loss or claim is covered by a policy of insurance maintained by Service Provider; (vi) damages arising from the gross negligence or willful misconduct of Service Provider, its employees, its subcontractors, or its agents; and (vii) damages arising from Service Provider’s breach of data security or confidentiality obligations owed under the Ancillary

Terms;

h. Any term permitting unilateral modification of the Ancillary Terms by Service Provider or any third party;

i. Any term obligating University to pay attorneys’ fees;

j. Any term requiring the confidentiality of records in contravention of the Nebraska public records statutes, Neb. Rev. Stat. §§ 84-712 to 84-712.09;

k. Any term binding University to any method of resolution of disputes under the Ancillary Terms not instituted in accordance with the provisions of Neb. Rev. Stat. §§ 81-8,302 to 81-8,306;

l. Any term requiring University to endorse or perform any act that may be perceived as an endorsement of a commercial good or service, Service Provider, or any third party;

m. Any term requiring University to waive its rights to a jury trial or to participate in a class action; or

n. Any term granting Service Provider or any third party a security interest in property of University.

IN WITNESS WHEREOF, the parties have entered into this Addendum as of the date set forth below.

Signature:

Printed Name:

Date:

Title:

Service Provider

Signature:

Printed Name:

VP of Sales/Business Development

Alex Busskohl

VP of Sales/Business Development

Alex Busskohl

08/07/25 | 09:06 CDT

08/07/25 | 09:06 CDT

VP of Sales/Business Development

Senior VP & CFO

Anne Barnes

Revised: 01/28/2022

Instructions:

1. All documents submitted to Procurement Contracts for REVIEW and/or SIGNATURE require the Document Cover Sheet completed

2. Email completed Cover Sheet along with all supporting documents (attachments, exhibits, etc.) to Contracts@nebraska.edu

3. Incomplete or incorrect forms and/or submission will be returned for clarification, additional information

I. Document Type: select type and complete all that apply

II. Description of Purchase:

III. Previous Actions:

Is this Request associated with OTHER contract/agreement(s) currently in effect with the University? Yes No If YES, provide the OTHER contract/agreement(s) documents with your submission.

IV. Basic Information: complete all sections

Request Date

Dept. Contact Name

SUPPLIER Name Dept./Area

Campuses participating

UNL UNO UNK UNMC

UNCA

Dept Contact Email

BOR

Reportable? Yes No

BOR Approval Meeting Date (if applicable)

BID #

(if applicable)

Reviewed by Legal (if applicable)

Spend for Initial Term / *New Spend only for Amendment

Spend for the full potential life (cumulative total)

Procurement

BUYER

Renewal Reminders?

Select all applicable recipients

None Buyer

Dept Contact

Copy(ies) to

# of days prior to expiration for notice

Initial Term Dates BEGIN thru END

Extension options (select one) one-year renewals none

V. Signature Routing:

DOCUMENT COVER SHEET

Describe what specifically is being purchased (if more spaced is needed, please provide attachments with additional documentations)

Describe any previous actions related to this purchase relevant for the university signer (ex. approved non-competitive, multiple quotes collected, previously bid and supplier changed, history of purchase)

Expenditure

Master Agreement (MSA)

The University of Nebraska at Omaha (UNO) is issuing this Request for Proposal to identify the most competitive provider of safe and reliable transportation to provide 1) shuttle service between Dodge and Scott Campuses, 2) intra-campus transportation to reduce on campus vehicle congestion,

3) a safe and convenient alternative to single occupancy vehicle trips, and 4) non-routine departmental requests. Arrow Stage Lines was the awarded bidder meeting all requirements.

Approved by the Board of Regents, August 11th, 2022.

08/11/2022

Arrow Stage Lines

3558-22-7811

$4,619,160 (3 years)

08/15/2022 08/14/2025

David Peterson

Parking and Transit davidpeterson@unomaha.edu

8/11/2022

Spencer Holm

$7,209,440.00 (All 5 years)

✔ 2

Signer 1 Alex Busskohl alex.busskohl@arrowstagelines.

com

Signer 2 President Carter

Select:

Select:

Select:

Select:

Select:

Select:

Select:

Emily Beattie mailto:ProcurementContracts@unl.edu

Revised May 2020 Page 1

UNIVERSITY OF NEBRASKA

MASTER AGREEMENT

This Master Agreement sets forth the terms between The Board of Regents of the University of Nebraska, a public body corporate and governing body of the University of Nebraska having an address at 3835 Holdrege Street, Lincoln, NE 68583 (the “University”) and Arrow Stage Lines, having an address at 4220 South 52nd Street Omaha, NE 68117 (the “Service Provider”) with regard to the performance by Service Provider of the services contemplated herein.

RECITALS

WHEREAS, the University desires to obtain the services of the Service Provider; and

WHEREAS, the Service Provider claims to have expertise and experience to provide such services for the

University;

THEREFORE, the University and the Service Provider hereby agree to the following terms, obligations and conditions:

1.…