Attachment+1+-+Workforce+SaaS+Agreement+Final.pdf

WorkForce Software, LLC SA-202005 Page 1 of 26

WORKFORCE SOFTWARE SAAS AGREEMENT

This WorkForce Software SaaS Agreement (the “Agreement”) is entered into between WorkForce Software, LLC, 38705 Seven Mile Road, Suite 300, Livonia, Michigan 48152 (“WFS”) and the “Customer” defined below.

Customer Name: State of North Dakota acting through its Information Technology Department

Address: 600 E Boulevard Ave Dept. 112

Bismarck, ND 58505-0100

1. Definitions

1.1. “Affiliate” means a legal entity separate from and controlled by or under common control with the either party. For purposes of this Agreement, the term “control” shall mean ownership of a beneficial controlling interest.

1.2. “Customer Data” shall mean any content, materials, data and information provided by the Customer to WFS in the course of using the SaaS Service.

1.3. “Documentation” shall mean all written or electronic materials provided to Customer by WFS for facilitating use of the SaaS Service as applicable but does not include advertising or similar promotional materials.

1.4. “Effective Date” is the Schedule Effective Date of the first executed Schedule.

1.5. “e-Learning Courseware” shall mean video or online training content and related materials which may be provided to Customer by WFS under a separate Schedule to this Agreement.

1.6. “Force Majeure” shall mean any event outside of the control of WFS, such as, but not limited to, a natural disaster, fire or extended power, electrical or Network outage, which renders the SaaS Service temporarily unavailable or permanently affects or prevents performance under this Agreement.

1.7. “Intellectual Property Rights” shall mean all copyrights, trade secrets, patents, and other intellectual property rights or portion thereof including, but not limited to, the ideas, methodologies, methods of operation, processes, and look and feel in the SaaS Service.

1.8. “Network” means the Internet, phone network, cell phone network, and other transmission methods by which the SaaS Service is delivered.

1.9. “Party” or “Parties” shall mean WFS or Customer individually or collectively.

1.10. “Production Environment” means an environment provided in the SaaS Service which Customer uses for live processing.

1.11. “Related Systems” shall mean Customer owned or operated computers, web-browsers, operating systems, firewalls, e-mail servers, LDAP servers, portals, Networks, third party software, internet connection, and any other hardware or software that connects to the SaaS Service or affects the SaaS Service if they are not configured or operating properly or are operating in such a manner as to cause an interruption or failure of the SaaS Service, whether or not provided by or configured by WFS.

[TITLE OF PROPOSAL]

WorkForce Software, LLC SA-202005 Page 2 of 26

1.12. “SaaS Service” or “SaaS Services” means the provision of access to and use of WFS software as a service platform, together with the provision of updates and upgrades, and related services including maintenance and support, all in accordance with the Agreement and the applicable Schedule.

1.13. “Schedule” means one or more written orders listing the services to be delivered to the Customer which is signed by both WFS and the Customer which references this Agreement.

1.14. “Service Level Agreement” or “SLA” means the service levels specified in Exhibit A.

1.15. “Support Services” shall mean the services specified in the Support Plan, including reasonable technical support via telephone, e-mail, and/or the web, to answer questions or provide assistance in the use of the SaaS Service.

2. Services Delivered

2.1. WFS shall provide access to the SaaS Service to Customer via the Network as specified in the Schedules. Any use of the SaaS Service prior to the Commencement Date specified in the Schedule(s) shall be considered a trial period during which the SLA shall not apply. Within the Production Environment, Customer may use only the applications and extensions specified in the Schedule(s), even if other applications and extensions are made available.

2.2. WFS may periodically update (“Update”) the SaaS Service, but makes no representations as to the frequency of new releases or the features, enhancements, or corrections that will be provided in the Updates.

2.3. Customer shall limit the access to the SaaS Service to its own employees, consultants, and other authorized users and shall not make the SaaS Service available to third parties or make it available on a service bureau basis.

2.4. WFS shall take commercially reasonable measures, consistent with those in the industry, to prevent unauthorized parties from gaining (a) physical access to the data centers where the SaaS Service is hosted, and (b) electronic access to the SaaS Service or the Customer Data. WFS shall promptly notify Customer of any unauthorized access to the SaaS Service which WFS detects.

2.5. WFS shall periodically backup the Customer Data (“Backup Services”) as specified in the SLA. WFS will undertake commercially reasonable steps to begin the restoration of Customer Data from the backup as soon as WFS is notified or becomes aware of the need to restore data. WFS shall not be responsible if Customer Data is lost or corrupted in between scheduled backups or for a reason caused by the acts or omissions of Customer. Customer Data shall not be used by WFS for any other purpose except to provide the services contemplated under the Agreement. WFS shall not preserve such Customer Data longer than contracted.

2.6. In a Force Majeure event, WFS shall make commercially reasonable efforts to restore the SaaS Service at an alternate facility as soon as feasible. Until such Force Majeure event shall have passed, the SaaS Service may be provided on a reduced use basis and may require Customer to make changes to the procedures used to access the SaaS Service. Neither party shall incur any liability to the other party on account of any loss or damage resulting from any delay or failure to perform all or any part of this Agreement, where such delay or failure is caused, in whole or in part, by a Force Majeure event. If a party asserts a Force Majeure event for failure to perform the party’s obligations, then the asserting party shall notify the other party of the event and take commercially reasonable steps to minimize the delay or damages caused by the Force Majeure event.

WorkForce Software, LLC SA-202005 Page 3 of 26

2.7. WFS shall provide the Support Services specified in the Support Plan. The Support Plan description attached as Exhibit B provides details of the service levels and items provided under each plan. Terms of the Support Plan supersede the terms in this Agreement.

3. Customer Responsibilities

3.1. Customer shall be responsible for entering its Customer Data into the SaaS Service and Customer shall be responsible for the maintenance of the Customer Data supplied by it. Customer hereby represents and warrants to WFS that the Customer Data is free of all viruses, Trojan horses, and comparable elements which could harm the systems or software used by WFS or its subcontractors to provide the SaaS Service. Customer agrees that it has collected and shall maintain and handle all Customer Data in compliance with all applicable data privacy and protection laws, rules and regulations.

3.2. Customer has sole responsibility to maintain the integrity, confidentiality and availability of information on Customer equipment.

3.3. Customer has sole responsibility to (a) check the accuracy of information processed using the SaaS Service, (b) run all normal processes and procedures within the SaaS Service such as end of period processing, imports, exports, and file transfers, and (c) manage and configure its Related Systems and ensure they operate properly. Customer is responsible for any inputs to the SaaS Service, including data and business rules that are set up for Customer, and any incorrect output that results therefrom.

When using and applying the information generated by the SaaS Service, Customer is responsible for ensuring that Customer complies with the applicable requirements of federal and state law. Customer agrees: (i) using the SaaS Service does not release Customer of any professional obligation concerning the preparation and review of such reports and documents, and (ii) Customer does not rely upon WFS or the SaaS Service for any advice or guidance regarding compliance with federal and state laws or the appropriate tax treatment of items reflected on such reports or documents.

3.4. Customer assumes all responsibilities and obligations and expertise with respect to (a) the selection of the SaaS Service to meet its intended results, and (b) any decision it makes based on the results produced by the SaaS Service. Customer understands and acknowledges that WFS and the Third Party Content Vendors are not engaged in rendering legal, accounting, tax or other professional advice either as a service or through the SaaS Service and it is not relying on WFS and the Third Party Content Vendors for any advice or guidance regarding laws and regulations. Customer shall review all calculations and determinations made using the SaaS Service and satisfy itself those results are accurate. If legal, accounting, tax or other expert assistance is required, the services of a competent professional will be sought by Customer. To the extent permitted by law, Customer shall indemnify and hold WFS harmless from claims and demands of its employees or former employees arising from the use by Customer of the SaaS Service.

3.5. Customer is solely responsible to ensure Related Systems operate properly. The support provisions of this Agreement do not apply to Related Systems or problems in the SaaS Service caused by Related Systems, regardless of who provided, installed, or distributed such. Should WFS identify that the root cause of a problem is caused by Customer modifications to the SaaS Service or behavior in Related Systems it shall notify Customer and request approval to provide additional assistance (if applicable).

Should Customer give its approval, the additional time spent by WFS after such approval shall be billed to customer on a time and materials basis at the then current rates.

3.6. Customer shall not perform any stress test, load test, or security test on the SaaS Service without first obtaining WFS permission and executing a separate agreement for the services required by WFS to support such tests.

WorkForce Software, LLC SA-202005 Page 4 of 26

3.7. Customer shall change all passwords used to access the SaaS Service at regular intervals. Should Customer learn of an unauthorized third party having obtained knowledge of a password, Customer shall inform WFS thereof without undue delay and promptly change the password. Customer will terminate old users in the SaaS Service.

3.8. Customer is responsible for monitoring user access to the SaaS Service.

3.9. Customer is responsible for the connection to the SaaS Service, including the Internet connection.

4. Term and Termination

4.1. The term of this Agreement starts on the Effective Date and terminates when all Schedules terminate.

Schedules automatically renew with thirty (30) days notice for additional one (1) year periods unless either party provides a written notice of termination to the other party at least thirty (30) days prior to the end of the then current term.

4.2. The provisions of Sections 2.5, 2.6, 3, 5, 7, 8.4, 8.5, 8.6 and any payment obligations incurred by Customer prior to or upon termination shall survive termination of this Agreement.

4.3. If either party commits a material breach of this Agreement, and should such breach not be corrected within thirty (30) days after receipt of written notice from the non-breaching party, this Agreement may be terminated by the non-breaching party upon written notice. Notwithstanding the foregoing, if the nature of the breach requires longer than thirty (30) days to cure, and WFS is taking commercially reasonable efforts to cure such breach at the end of the initial thirty (30) day cure period, WFS shall have a reasonable time thereafter to continue to effectuate a cure of such breach.

Upon termination in such instance, WFS shall refund the unexpired portion of any fees paid.

4.4. Upon the effective date of termination, Customer’s access to the SaaS Service will be terminated.

Thirty (30) days after the effective date of termination, WFS shall have no obligation to maintain or provide any Customer Data. Upon termination of the Agreement, WFS shall use commercially reasonable efforts to permanently and irrevocably remove, purge or overwrite all data still remaining on the servers used to host the SaaS Service, including, but not limited to, Customer Data, unless and to the extent applicable laws and regulations require further retention of such data. All indemnifications relating to the unauthorized disclosure of Customer Data shall continue until such data is returned to Customer or destroyed.

5. Proprietary Right, Non-Disclosure

5.1. WFS shall retain all rights, title, and interest in the e-Learning Courseware, Third Party Services and the SaaS Service. Customer shall not alter, modify, copy, edit, format, translate, or create derivative works of these materials, except as provided herein or when approved in writing by WFS.

5.2. As between WFS and Customer, Customer shall own all title, rights, and interest in Customer Data.

5.3. Both parties agree to comply with all applicable privacy and data protection statutes, rules, or regulations governing the respective activities of the parties. Customer hereby consents to the use, processing and/or disclosure of Customer’s data only for the purposes described herein and to the extent such use or processing is necessary for WFS to carry out its duties and responsibilities under this Agreement or as required by law.

5.4. SAAS NOTICE

All notices or other communications required under this exhibit must be provided to the following:

STATE – Information Technology Department WFS

WorkForce Software, LLC SA-202005 Page 5 of 26

Shawn Riley Name: Legal Department Chief Information Officer Title 4201 Normandy Street Address: 38705 Seven Mile Road, Suite 300 Bismarck, ND 58503 City, State, Zip: Livonia, MI 48152 701-328-1001 Phone sriley@nd.gov Email: legal@workforcesoftware.com

5.5. Discovery.

If WFS receives a request which may reasonably be interpreted as requiring access to the Data of the Customer or the Customer’s use of the SaaS, WFS shall provide notice, by phone and through electronic mail, to the individuals identified in the SAAS NOTICE section of this Exhibit, unless prohibited by law from providing such notification. WFS shall provide such notification within forty-eight (48) hours after WFS receives the request. WFS shall not respond to subpoenas, service of process, Public Records Act requests, and other legal requests directed at WFS regarding this Contract without first notifying the Customer unless prohibited by law from providing such notification. WFS agrees to provide its intended responses to the Customer with adequate time for the Customer to review, revise and, if necessary, seek a protective order in a court of competent jurisdiction. WFS shall not respond to legal requests directed at the Customer unless authorized in writing to do so by the Customer.

6. Payments, Credits, and Refunds

6.1. Customer shall pay all fees specified in the Schedule(s) to WFS or its designated representative. Unless specified otherwise in the Schedule(s): (i) fees are based on services purchased in the Schedule(s) and overage fees, (ii) payment obligations for the Service Term specified in each Schedule are non-cancelable and fees paid are non-refundable, unless termination occurs under the Master Contract, Section 4A, (iii) the quantities ordered under the Schedule cannot be decreased during the term, and

(iv) all fees quoted and payments made hereunder shall be in U.S. Dollars. The Schedule(s) specify how the Customer may use the SaaS Service and how the usage of the SaaS Service will be measured.

Customer may increase its committed Quantity (as defined in the applicable Schedule) during the Term of the Schedule by executing a quote by and between the parties which details the increased Quantity. Such quote shall be co-terminus with the Schedule which details the previously committed Quantity.

6.2. Intentionally Omitted

6.3. Customers outside of the United States shall pay all invoices via electronic transfer. All invoices submitted shall be due Net 30. If Customer reasonably disputes an invoice, Customer must pay the undisputed amount when due and submit written notice of the disputed amount (with details of the nature of the dispute and the invoice(s) disputed) within thirty (30) days of receipt of the invoice. WFS may assess interest at the rate of 1.5% per month or the maximum allowed by law on balances not paid when due. In the event that Customer is more than sixty (60) days past due and/or after two (2) written notifications of a past due amount, WFS reserves the right to suspend Customer’s access to the SaaS Service unless and until Customer makes full payment of all past due fees.

6.4. Upon written notice by Customer to WFS of its failure to satisfy the Uptime Commitment of the SLA within thirty (30) days of the end of a month, WFS shall credit Customer the fees as calculated in the SLA towards the next payment due from Customer.

7. Warranties and Indemnifications

WorkForce Software, LLC SA-202005 Page 6 of 26

7.1. WFS shall, at its expense, indemnify, defend and hold Customer harmless from and against any third-party claim that the SaaS Service infringes an Intellectual Property Right; provided, however, that (a) Customer promptly notifies WFS of any such claim, and (b) any attorney appointed to represent the State must first qualify as and be appointed by the North Dakota Attorney General as a Special Assistant Attorney General as required under N.D.C.C. § 54-12-08, and (c) Customer gives WFS such information and/or assistance in the defense thereof as WFS may reasonably request. In no event shall Customer settle any such claim without the written consent of WFS. If the SaaS Service is adjudged to infringe an Intellectual Property Right by a court of competent jurisdiction, WFS shall, at its expense and election either: (i) procure the right for Customer to continue using the infringing items, (ii) replace the infringing items with a functionally equivalent non-infringing product, (iii) modify the infringing items so that they are non-infringing, or (iv) terminate the affected Schedule and refund the unexpired portion of any fees paid. In no event shall WFS, its employees, agents and sub-contractors be liable to the Customer to the extent that the alleged infringement is based on: (a) a modification of the SaaS Services or Documentation by anyone other than WFS, or (b) the Customer's use of the SaaS Services or Documentation in a manner contrary to the instructions given to the Customer by WFS, or (c) the Customer's use of the SaaS Services or Documentation after notice of the alleged or actual infringement from WFS or any appropriate authority.

7.2. WFS represents and warrants: (a) it has the right to grant the rights specified herein, and (b) the SaaS Service will not contain any viruses or Trojan horses.

7.3. THE WARRANTIES AND REMEDIES SET FORTH HEREIN ARE EXCLUSIVE AND IN LIEU OF ALL OTHERS, WHETHER ORAL OR WRITTEN, EXPRESSED OR IMPLIED. EXCEPT AS SPECIFICALLY SET FORTH IN THIS SECTION 7, WFS SPECIFICALLY DISCLAIMS ANY AND ALL IMPLIED WARRANTIES TO THE SAAS SERVICES

AND ANY OTHER MATTER WHATSOEVER. IN PARTICULAR, BUT WITHOUT LIMITATION, WFS

SPECIFICALLY DISCLAIMS ANY AND ALL IMPLIED WARRANTIES OR CONDITIONS OF

MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT OF THIRD

PARTY RIGHTS OR ANY OTHER WARRANTY ARISING FROM A COURSE OF DEALING OR USAGE OF

TRADE. NO WFS AGENT, CONTRACTOR OR EMPLOYEE IS AUTHORIZED TO MAKE ANY MODIFICATION TO THIS WARRANTY, UNLESS IN A SIGNED WRITING EXECUTED BY A WFS EMPLOYEE WITH ACTUAL AUTHORIZATION TO BIND WFS. WFS DOES NOT WARRANT THAT THE SAAS SERVICE OR ANY PORTION THEREOF WILL OPERATE UNINTERRUPTED, WILL BE ERROR FREE OR THAT WFS WILL CORRECT ALL

NON-MATERIAL ERRORS.

7.4. Intentionally Omitted

7.5. Intentionally omitted

8. Cyber Liability WFS shall secure and maintain Cyber Liability and Security Insurance or equivalent insurance product(s), with minimum liability limits of not less than $5,000,000 and first party limits of not less than $1,000,000, that will provide, without cost to the WFS or Customer, an immediate response in the event of a data breach, including meeting all notification obligations of WFS and Customer and in the event the data breach involves personal information as defined by N.D.C.C. § 51-30-1(4), the insurance policy shall also make available free credit monitoring for any affected individual for a minimum period of one year. WFS shall defend, indemnify, save and hold harmless, the Customer, its officers, agents and employees from liability of from third-party claims, including reasonable costs and expenses, to the extent arising out of a data breach arising from WFS’ failure to fulfill its obligations herein regarding the hosting, transmission, or control of data, any and all suits, third-party claims, or damages of any character whatsoever caused by WFS or its subcontractors.

WorkForce Software, LLC SA-202005 Page 7 of 26

9. General Provisions

9.1. Each party may include the other party’s name or logo in a list of its clients, vendors, or service providers. Each party may make reference to the other in an initial press release, provided that any use of the other party’s trademark(s) retain proprietary notices and/or are properly attributed to their owner and also provided that any such press release will require the review and prior written consent of both parties, which shall not be unreasonably withheld, conditioned, or delayed.

9.2. In recognition of the pricing provided under this Agreement, Customer shall (subject to its reasonable right to review and approve): (a) allow WFS to include a brief description of the SaaS Service and Global Services furnished to Customer in WFS promotional materials, and (b) allow WFS to make reference to Customer in case studies, ROI analyses, white papers and related marketing materials, and (c) serve as a reference for WFS potential clients, and (d) provide interviews to the news media and provide quotes for press releases, and (e) organize mutually convenient site visits for WFS potential clients, and (f) make presentations at conferences, upon WFS reasonable request and at WFS’s cost.

9.3. Intentionally Omitted

9.4. Intentionally Omitted

9.5. Each party shall be liable for breaches of its Affiliates and contractors under this Agreement.

9.6. EACH PARTY ACKNOWLEDGES THAT THE WARRANTY DISCLAIMERS, LIABILITY AND REMEDY

LIMITATIONS, AND SERVICE LEVELS IN THIS AGREEMENT ARE MATERIAL BARGAINED FOR BASES OF THIS AGREEMENT AND THEY HAVE BEEN TAKEN INTO ACCOUNT AND REFLECTED IN DETERMINING THE CONSIDERATION TO BE GIVEN BY EACH PARTY UNDER THIS AGREEMENT AND IN THE DECISION

BY EACH PARTY TO ENTER INTO THIS AGREEMENT.

IN WITNESS WHEREOF, the Parties have executed this Agreement and the Exhibits indicated below as of the Effective Date.

EXHIBITS

[x] Exhibit A – Service Level Agreement

[x] Exhibit B – Support Plan Descriptions

[x] Exhibit C – Data Security Addendum

[x] Exhibit D – Privacy Addendum

[x] Exhibit E – Data Retention Policy

[x] Exhibit F – Third Party Services

[x] Exhibit G – Pre-Approved Third Party and Affiliate Subprocessors

WorkForce Software, LLC SA-202005 Page 8 of 26

CUSTOMER WORKFORCE SOFTWARE LLC

Date: Date:

Signature: Signature:

Printed Name:

Printed Name:

Title: Title:

WorkForce Software, LLC SA-202005 Page 9 of 26

EXHIBIT A – SERVICE LEVEL AGREEMENT

WFS shall provide the following service levels for the SaaS Service during the term of this Agreement.

Service Area Service Level Commitment

Uptime Commitment Production Environments: 99.5%

Backup Services WFS is responsible for backup and restore of data stored in the SaaS Service.

WFS shall backup all Customer Data in its entirety every seven (7) days.

WFS shall backup all changes to Customer Data every twenty-four (24) hours.

Data Retention Customer Data will be kept online for three (3) years or 30 days from end of the contracted service, whichever comes first. Upon Customer’s request, WFS will retain Customer Data for a period longer than three (3) years according to the fee schedule listed in the WFS Data Retention Policy.

Disaster Recovery Time Objective

Except as otherwise noted herein, failover of Production Environment functionality to the Disaster Recovery site will occur within twelve (12) hours of WFS declaring a Disaster.

Disaster Recovery Point Objective

Maximum data loss of one-and-a-half (1.5) hours of data stored in the Production Environment.

NOTES, DEFINITIONS, AND ADDITIONAL TERMS

The following notes, definitions, and additional terms are an integral part of the Service Level Agreement.

1. “Disaster” means an event after which WFS determines the SaaS Service should be failed over to the disaster recovery site.

2. “Downtime” means the Total Minutes in the Month during which the Production Environment is not available, except for Excluded Downtime.

3. “Excluded Downtime” means Total Minutes in the Month attributable to:

1. Scheduled Maintenance Windows;

2. SaaS Service updates;

3. Content provided by Third Party Content Vendors;

4. Unavailability caused by factors outside of WFS’s reasonable control, such as unpredictable and unforeseeable events that could not have been avoided even if reasonable care had been exercised, including, without limitation, a Force Majeure event.

4. “Month” means a calendar month.

5. “Total Minutes in the Month” are measured 24 hours at 7 days a week during a Month.

WorkForce Software, LLC SA-202005 Page 10 of 26

6. "Scheduled Maintenance Windows" means a window of time during which the SaaS Service may be down for maintenance, which window is (a) 3:00 am Sunday to 4:00 am Sunday U.S. Eastern Time for the US and Canada data centers (b) 3:00 am Sunday to 4:00 am Sunday Central European Time for the European data centers; (c) 3:00 am Sunday to 4:00 am Sunday Australian Eastern Time for the Asia Pacific/Australia data centers; (d) for an extended maintenance window in which case the customer will be notified at least ten (10) business days in advanced; and (e) a maintenance window scheduled with the customer to perform maintenance or updates to the customer’s Production Environment.

7. “System Availability Percentage” means the average percentage of total time during which the Production Environment is available to Customer and is calculated as follows:

𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆 = (�

𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇ℎ𝑒𝑒𝑒𝑒𝑒𝑒𝑒𝑒𝑒𝑒ℎ − 𝐷𝐷𝐷𝐷𝐷𝐷𝐷𝐷𝐷𝐷𝐷𝐷𝐷𝐷𝐷𝐷

𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇ℎ𝑒𝑒𝑒𝑒𝑒𝑒𝑒𝑒𝑒𝑒ℎ

� ∗ 100)

8. Data collection terminals will continue to accept swipes during system downtime and swipes will be uploaded when the SaaS System becomes available.

9. If Customer elects to have any services provided by a third party, WFS shall have no liability for any defect or failure of the SaaS Service caused by such third-party services, and Customer shall not be entitled to any reduction in fees for the SaaS Service. WFS may deny access to the SaaS Service to any third party which WFS determines in its sole discretion poses a security risk or other risk to WFS systems, data or intellectual property.

10. To ensure WFS can proactively added resources to a Customer’s environment so that performance or availability is not impacted, Customer shall notify WFS in writing at least sixty (60) days in advance of any period when it reasonably believes the number of Active Employees or peak usage transaction volume to the SaaS Service may increase by more than 20% over the prior thirty (30) day period and at least ninety (90) days in advance if it expects more than a 50% increase. Failure to provide such notification shall release WFS of the Uptime and Support Estimated Resolution Times obligations herein for a period of ninety (90) days from the date such increase occurred.

11. The Uptime Commitment does not apply in the first thirty (30) days of use in a Production Environment, during which time WFS may need to tune the environment for Customer based on its actual usage patterns.

12. The Uptime Commitment does not apply during a Force Majeure event and shall be reinstated again only after service has been fully restored at the primary facility.

13. Access to archived or backup data, if available, will be quoted to Customer, provided as a Global Service, and may be made available as a database extract or in a separate environment

CREDITS IF WFS FAILS TO MEET THE UPTIME COMMITMENT

If Customer provides written notice to WFS of WFS’s failure to satisfy the Uptime Commitment within thirty (30) days of the end of a month, WFS will credit to Customer 10% of Monthly Subscription Fees for each 1% below SLA, not to exceed 100% of Monthly Subscription Fees.

WorkForce Software, LLC SA-202005 Page 11 of 26

EXHIBIT B – SUPPORT PLAN DESCRIPTIONS

1. Estimated Service Levels

Support Ticket Type Initial Response Times

Severity Level 1 1 Hour from Initial Request (24x7)**

Severity Level 2 2 Hours from Initial Request (24x7)**

Severity Level 3 1 Business Day from Initial Request*, **

Support Ticket Type Estimated Resolution Times

WorkForce Suite

Severity Level 1 4 Hours from Initial Response

Severity Level 2 1 Business Day from Initial Response Severity Level 3 3 Business Days from Initial Response*

*Excepting requests that require a patch or new functionality.

**Requires Customer to follow proper procedures for contacting WorkForce of a suspected Sev 1 or Sev 2 issue.

Customers are required to contact the WorkForce Support hotline opposed to submitting the ticket through the WorkForce ticketing system.

**Standard support Customers: 85% commitment to achieving response SLA guarantee.

**Premium support Customers: 98% commitment to achieving response SLA guarantee.

2. Severity Level Definitions

• Severity Level 1: Production application services are down and no workaround is immediately available.

All or a substantial portion of the application or critical data is unavailable or at a significant risk of loss or corruption. Business operations have been severely disrupted. Severity 1 support requires the client to have dedicated resources available to work with WFS on the issue on an ongoing basis while the issue is active.

• Severity Level 2: Major application functionality is severely impaired and a temporary workaround is available. Application services are impaired however continue to function without an immediate impact to the critical components of the application. Long term issues may occur if not addressed however are not imminent. A major business milestone is at risk.

• Severity Level 3: All other issues not categorized as Severity Level 1 or 2. A Severity Level 3 issue is an issue that results in a non-critical loss of application services or functionality. A workaround may or may not be available that allows the user to continue to use the non-critical application functionality. Severity Level 3 does not include new enhancements to any WFS product.

3. General Plan Definitions, Hours and Availability

• Response time is the time from Customer’s call into WFS until a return call is provided.

• WFS support will make analysts available for phone contact Monday through Friday from 8:00 am – 6:00 pm during the business hours observed in Customer’s time zone (where Customer’s headquarters are

WorkForce Software, LLC SA-202005 Page 12 of 26 located), excluding the holidays listed below. For the purposes of this document, those business hours will be described as “Standard Support Call Times.”

• WFS and its support staff observe public holidays of England, New South Wales or U.S federal holidays.

No live support is offered to Customer on those days, except for Severity Level 1 and Severity Level 2 issues.

• WFS provides Live Phone Support coverage for critical issues outside of Standard Support Call Times as defined below:

• WFS may modify the service levels, fees, and offerings of any Support Plan, but such changes shall not apply to the Support Plan for the current Support term.

• WFS support will address reported “defects” to WFS applications, which result in a loss of previously available functionality and performance.

• New enhancements, including, but not limited to paycode, pay rules, accrual banks, holiday policies, etc.

will be routed to WFS’s Service Request Department for completion.

• All Global Services will be directly invoiced to customer as Billable Technical Support at the applicable hourly rate after services have been rendered.

• All enhancement requests estimated over sixteen (16) hours will require the generation of a Statement of Work defining the project scope and will be assigned a WFS project manager.

• Customers selecting Standard Support are able to elect up to six (6) Support contacts and understands that a minimum of two (2) contacts must be Level 1 Certified at all times on all modules subscribed to.

Premium Support Customers are able to elect up to ten (10) Support contacts and understands that a minimum of two (2) contacts must be Level 2 Certified on all modules subscribed to at all times.

o Standard Support Customers are granted two (2) free registrations to courses required to reach Level 1 Certification on all modules subscribed to and are required to complete the training one hundred eighty (180) days from the Effective Date.

o Premium Support Customers are granted two (2) free registrations to courses required to reach

Level 1 and Level 2 Certification on all modules subscribed to and are required to complete Level 1 Certification training one hundred eighty (180) days from the Effective Date and within sixty

(60) days after “go live” for Level 2 Certification.

• Once the Customer has utilized it’s two (2) free registrations for certifications as described above, any other registrations are billed at market price. For clarity, any renewal terms are not granted additional free registrations.

24 x 7 Live Phone Support

Severity Level 1 Included

Severity Level 2 Included

Severity Level 3 Will be addressed according to the Estimated Resolution Target

WorkForce Software, LLC SA-202005 Page 13 of 26

• Customers without either Standard or Premium Support Plans must pay the market price for Customer Certification courses.

• Certified Contact will be defined as a support contacts that have successfully completed Level 1 Certification required for Standard Support or : Time and Attendance Troubleshooting and/or Forecasting and Scheduling Troubleshooting and/or Level 1 & 2 Certification required for Premium Support for all products purchased.

• Customer’s uncertified contacts will have access to WFS support staff to report only Severity Level 1 or 2 incidences.

• Certified Contacts are required to request and approve all alterations of the Service.

• All certifications remains valid for two (2) years and must be renewed within sixty (60) days of the anniversary of the certification Effective Date.

• If any of the named certified contacts are replaced by the Customer, the newly named contact(s) shall complete the appropriate WorkForce Certification Process within sixty (60) days of being selected.

• Customers electing the Premium support plan will receive a twenty (20) percent discount on WFS’s standard rates for all post implementation “Go Live” Services. The foregoing discounts shall not apply to any Managed Services.

• Premium Support Plan Customers will receive a twenty (20) percent discount on VISION registration fees and one (1) Health Check Service per schedule term, as requested, starting upon the schedule effective date.

• Health Check Service is defined as an in-depth analysis of the configuration/environment where WFS consults with the customer, conducts interviews and provides an executive summary of recommendations.

4. Data Collection Terminals (if applicable)

• “DCT” shall mean the data collection terminal(s) rented or purchased under an applicable Schedule. If the DCT is rented by the Customer under a Hardware Rental Schedule, the term of the DCT Support Plan shall match the term of the rental. If the DCT is purchased by the Customer under a Hardware Purchase Schedule, the term of the DCT Support Plan shall be listed in the applicable Schedule, subject to any renewal terms.

• DCT Severity Level Definitions:

• Severity Level 1: A critical problem that renders one or more key functions of the DCT unusable, no reasonable work around exists, and for which immediate resolution is required to meet processing deadlines.

• Severity Level 2: Any other critical problem that renders one or more key functions unusable.

• Severity Level 3: Any other problem with the DCT that is not at the Severity 1 or Severity 2 level.

• Both Support Plans cover the cost of parts, labor, and shipping to Customer’s facility for any covered repairs for manufacturer’s defects and manufacturer’s workmanship of the DCT. Customer is responsible for shipping charges to WFS. To make a support claim, Customer shall first contact WFS and speak to the

WorkForce Software, LLC SA-202005 Page 14 of 26

WFS support department. After diagnosis and upon authorization, Customer will be provided shipping instructions to return the unit to WFS for repair.

o Under Standard Support, WFS repairs the DCT, or if in its opinion such repair cannot be made, it will provide a replacement DCT. Repairs are generally completed within 5-10 business days. WFS makes no delivery guarantees for delays caused by international shipping or customs. WFS will return units to the Customer at no charge via ground shipping. Alternate shipping methods may be selected by the Customer at an additional charge.

o Under Premium Support, WFS ships a replacement DCT overnight at no cost to Customer the same business day (or the next business day for calls after 3 pm Eastern Time). WFS makes no delivery guarantees for delays caused by international shipping or customs. Customer ships the faulty DCT to WFS concurrently via ground shipping. If the faulty DCT is not received within ten (10) business days, Customer will be invoiced for the DCT shipped.

• The Support Plans only cover repairs or replacement units of the same type and model. If parts or replacement units are not available, a next generation DCT will be provided.

• Customer shall be responsible for all set up and maintenance of the DCT’s on Customer site. WFS will not provide installation assistance under either Support Plan.

• Notwithstanding anything to the contrary contained herein, in no event shall any Support Plan for DCT extend or be effective beyond six (6) years from the Effective Date except upon mutual agreement of the parties.

• Normal wear and tear and intentional damage to equipment is excluded and fees for such DCTs will be chargeable to Customer at WFS’s standard charges for parts and labor upon receipt of any such DCT. WFS makes no representations on the availability of parts or replacement units. WFS reserves the right to deliver new DCTs, repaired DCTs, or refurbished DCTs at its option for any covered repair. WFS’s obligation shall be subject to our determination that the DCT has not been modified, serviced, or repaired by any other party and that the product was installed and operated within the product specifications for its intended use. Any misuse, negligence, accident, abuse, or alteration of a serial number will void the support obligations. The Support Plan extends solely to the original purchaser of the DCT and all claims must be made by the Customer.

• THE SUPPORT PLAN EXPRESSLY PROVIDED HEREIN IS THE SOLE WARRANTY AND OBLIGATION OF WFS WITH RESPECT TO THE DCT. ALL OTHER WARRANTIES, EXPRESSED OR IMPLIED ARE HEREBY DISCLAIMED, INCLUDING, BUT NOT LIMITED TO, ANY WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. WFS’S LIABILITY SHALL IN ANY EVENT BE LIMITED TO THE REPAIR, REPLACEMENT, OR IF NEITHER IS FEASIBLE, A REFUND OF THE RENTAL FOR THE PERIOD THE DCT IS NOT FUNCTIONING OR THE

PURCHASE PRICE OF THE DCT AS APPLICABLE.

• The Support Plans provide for full intellectual property indemnification of Customer for the DCT and the DCT Software while under support, per the indemnification provisions of the Agreement.

WorkForce Software, LLC SA-202005 Page 15 of 26

EXHIBIT C - DATA PROTECTION

WFS will adhere to best practice standards in security risk management for the SaaS Service.

1. Data Protection Planning and Management

1.1. Data Protection Program - WFS will implement and maintain a data protection strategy, program, policies, and initiatives to ensure the security, privacy and relevant regulatory requirements are updated and met consistently.

1.2. Risk Assessment and Treatment - The Information Security function in association with the Legal function will have developed an enterprise-wide risk management program that integrates governance, risk management, and compliance at all key operational levels such as: security, privacy, regulatory requirements, business operations, customers’ requirements, etc.

1.3. Data Protection Policies - WFS will develop and implement data protection policies and standards that apply to all employees, contractors, part-time and temporary workers to perform work on company premises.

1.4. Security and Privacy Awareness Training Program - An awareness training methodology will be in place to ensure that WFS's policies and standards are being adhered to by employees, contractors, part- time and temporary workers.

1.5. Code of Conduct and Acceptable Use Policy - WFS will ensure that all employees, contractors, part-time and temporary workers processing, having access to, or managing Customer data as well as working directly with customers adhere to a Code of Conduct and Acceptable Use Policy.

1.6. Regulatory Requirements and Industry Best Practices - WFS will exercise due diligence to ensure compliance with various regulatory requirements. In addition, WFS will provide Customer evidence of compliance with SSAE 16, SOC 2 and other industry standard requirements as applicable. If required, WFS will provide a detailed description of the audited Control Environment. If Customer determines the Control Environment is not satisfactory, the Customer may request WFS to correct any deficiencies.

1.7. Remote access to Data from outside the continental United States, including remote access to Data by authorized SaaS support staff in identified support centers, is prohibited unless approved in advance by Chief Information Officer of the State. EXHIBIT G – PREAPPROVED THIRD PARTY AND AFFILLIATE SUBPROCESSORS lists authorized third parties and remote locations.

1.8. WFS will ensure that its data protection program includes the use of appropriate vulnerability scanning tools and techniques to scan for vulnerabilities in its information systems that impact Customer data. Scanning activities will be scheduled to avoid interference with Customer' operations and network traffic.

2. Physical and Environmental Security

2.1. Alternate Secure Site - WFS will identify an alternate secure site for the storage of information system backup media.

2.2. Physical Access Points - WFS will control all physical access points (including designated entry/exit points) to facilities containing information systems and issues appropriate authorization credentials for personnel with authorized access to facilities containing information systems (except for those areas within the facilities officially designated as publicly accessible). WFS will ensure that third-party

WorkForce Software, LLC SA-202005 Page 16 of 26 colocation providers meet WFS minimum standards for access security, but that actual management of that security will be performed by the colocation provider.

2.3. Eavesdropping prevention - WFS will control, using commercially reasonable standards, the physical access to information system transmission lines carrying unencrypted or unencrypted information to prevent eavesdropping, in-transit modification, disruption, or physical tampering.

3. Operational Procedures and Responsibilities

3.1. Change Management - WFS will use commercially reasonable standards to manage changes to information systems within our control.

3.2. Separation of Duties - WFS's information system will enforce separation of duties through assigned access authorizations.

3.3. Malicious Software Prevention - Appropriate controls (anti-virus software, anti-malware, patch management) will be implemented to detect, remove and to prevent the introduction or spread of unauthorized software, malicious software, and other malware.

3.4. Backup Management - WFS will adhere to best practice standards with regards to backups of data and information systems. Backups will be recovered in a timely manner in case of system failures.

3.5. Media Management - Appropriate controls over media creation, storage and disposal will be in place to protect Customer data from unauthorized access.

4. Network Security Management

4.1. Attack Prevention - WFS will employ adequate measures to protect the networks hosting information systems against or limit the effects of attacks by unauthorized users.

5. Online Transactions – Data Encryption

5.1. Encryption Mechanisms - Controls to ensure the use of encryption mechanisms, preventing unauthorized disclosure of information, will be used by WFS to satisfy data protection requirements.

Such controls will ensure data is protected while being transmitted and at rest unless protected by alternative physical measures.

5.2. Information designated as sensitive, including PII, shall be encrypted end-to-end while it is in transit and at rest. Data must be encrypted using the most current Federal Information Processing Standard (FIPS) 140-2 compliant cryptographic modules and the current Advanced Encryption Standard algorithm.

6. Online Transactions – Information Integrity

6.1. Unauthorized Changes - WFS's information system will use its best efforts to protect against unauthorized changes to information.

7. Monitoring

7.1. Access Monitoring – Authorized and unauthorized access to WFS's information system will be monitored.

8. Access Control

8.1. NDA - All contractors, consultants, and temporary employees of WFS will sign the WFS Non-Disclosure Agreement.

WorkForce Software, LLC SA-202005 Page 17 of 26

8.2. Account Review – WFS will review user accounts accessing customer data on a regular basis.

Frequency will be based on application risk and data classification. Inactive accounts will be deactivated following WorkForce Software policies and standards.

8.3. Separation of Duties - WFS's information system will use commercially reasonable efforts to enforce separation of duties through assigned access authorizations.

8.4. Least Privilege - The information system will use commercially reasonable efforts to enforce the most restrictive set of rights/privileges or accesses needed by users for the performance of specified tasks.

8.5. Need-to-know Only Principle - WFS will use commercially reasonable efforts to ensure that the use of data by end-users is based on the need-to-know only principle.

8.6. Password Use - All WFS users will be required to change passwords, avoiding re-using or cycling old passwords, and at regular intervals of 90 days or whenever there is any indication of possible system or password compromise. Users will be trained to keep passwords confidential. There will be no sharing of user accounts and passwords among employees, contractors, part-time and temporary workers.

8.7. Unattended User Equipment - WFS's information system will provide mechanisms for locking sessions either user initiated or automatically controlled by locking the session after a maximum of 15 minutes of inactivity.

8.8. Privileged Password Management - Privileged access for network, system or application functions in production system will be controlled and restricted to as few personnel as operationally feasible.

Default password or other embedded security bypass mechanism from manufacturer will be changed or disabled.

9. Information Systems Acquisition, Development and Maintenance

9.1. Continuous Monitoring - Information resources will be used to identify and maintain awareness of relevant technical vulnerabilities.

9.2. Periodic Maintenance - WFS will schedule, perform, and document routine preventative maintenance on the components of the information system in accordance with manufacturer or vendor specifications and/or agreed to Customer requirements.

10. Information Security Incident Management

10.1. Incident Response Procedures - WFS will develop, implement and maintain formal, documented procedures to facilitate the implementation of the incident response policy and associated incident response controls.

10.2. Incident Response Notification - WFS will inform Customer of a security or privacy breach within 24 hours of confirmation of said breach.

10.3. Upon discovery or reasonable belief of any Data Breach, WFS shall provide notice, by phone and through electronic mail, to the individuals identified in SAAS NOTICE section of this Exhibit. WFS shall provide such notification within the lesser of twelve (12) hours or the timeframe required by applicable laws and regulations after WFS reasonably believes there has been such a Data Breach. To the extent known at the time of notification, WFS’s notice shall include:

1. The nature of the Data Breach;

2. The Data accessed, used or disclosed;

3. The person(s) who accessed, used, disclosed and/or received Data (if known);

4. What WFS has done or will do to quarantine and mitigate the Data Breach; and

WorkForce Software, LLC SA-202005 Page 18 of 26

5. What corrective action WFS has taken or will take to prevent future Data Breaches.

10.4. WFS will provide daily updates, or more frequently if…