ESBD_448305_1755812863381_EXHIBIT B CONTRACT PROVISIONS.pdf

Approved August 20, 2024. Page 1 of 11

EXHIBIT B

CONTRACT PROVISIONS

1. Confidential Information, Public Information, and Information Security

1.1 Contractor Information. TDLR may need to collect selected information from Contractor such as name, e-mail addresses, taxpayer identification number, references, insurance coverage, and capacity to deliver. The purpose of collecting these items is to facilitate the performance of and payment for services provided under this Contract. While some items may be subject to disclosure under the Texas Public Information Act, TDLR will not sell this information to private entities.

1.2 Protected Health Information. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) privacy regulations implemented standards for how information that identifies a patient can be used and disclosed. The Texas Medical Records Privacy Act (TMRPA) applies to any person who engages in the practice of assembling, collecting, analyzing, using, evaluating, storing, or transmitting Protected Health Information (PHI). Contractor certifies that it is in and will remain in compliance with both HIPAA and TMRPA.

1.3 Public Information Act. Information, documentation, and other material in connection with this contract or any resulting contract may be subject to public disclosure pursuant to Chapter 552 of the Texas Government Code (the "Public Information Act"). In accordance with Section 2252.907 of the Texas Government Code, Contractor is required to make any information created or exchanged with the State pursuant to the contract, and not otherwise excepted from disclosure under the Texas Public Information Act, available in a format that is accessible by the public at no additional charge to the State.

1.4 Data Management and Security Controls. In accordance with Section 2054.138 of the Texas Government Code, Contractor certifies that it will comply with the security controls required under this contract and will maintain records and make them available to

TDLR Information y communication or representation of knowledge such as facts, data, or opinions in any medium or form, including textual, numerical, graphic, cartographic, narrative, electronic, or audiovisual forms. TDLR information includes other all data that is generated by Contractor in the performance of a contract with TDLR. TDLR Information System ers to those devices, software, networks, and related infrastructure that TDLR owns, operates, or has obtained for use to conduct TDLR business. Devices include, but are not limited to, TDLR-owned or managed storage, processing, and communications devices, as well as personally owned devices.

1.5 Confidential Data Protection. Contractor represents and warrants that it will implement, maintain, and use appropriate administrative, technical, and physical safeguards to preserve the confidentiality, integrity, and availability of TDLR Information.

Contractor will not collect, access, use, disclose, or retain TDLR Information other than as necessary to perform the services specified in a contract resulting from this solicitation or as otherwise authorized in writing by TDLR. Contractor will restrict access to TDLR Information to o Contractor will maintain, at all times, an updated, complete, and accurate list of personnel authorized to access TDLR Information and supply it to TDLR upon request. Contractor will not use TDLR Information, or any information derived from TDLR Information, for its benefit or the benefit of any other person or entity.

Contractor ress written consent.

1.6 Data Destruction. In the event hardware used by Contractor to store TDLR data is permanently taken out of service or repurposed for any reason, Contractor will use NIST 800-88 methodologies to permanently render TDLR's data unreadable to third parties.

In the event hardware used by Contractor is permanently taken out of service or repurposed, Contractor shall notify TDLR of the method of sanitization. This requirement shall survive the terms of the Contract and is applicable as long as Contractor uses or has in service any hardware used to store data transferred to Contractor under this contract.

1.7 Media Sanitization. Contractor shall sanitize information system media, both digital and non-digital, in accordance with NIST Special Publication 800-88 (Guidelines for Media Sanitization) when TDLR Information in the custody of Contractor is no longer required to be retained by contract with TDLR. Contractor must maintain a record documenting each sanitization procedure that, at a minimum, includes the following information: (i) date sanitization completed, (ii) description of the item(s), serial number(s), inventory control number(s), if applicable, and (iii) sanitization method used. No later than sixty (60) calendar days from contract expiration or termination or as otherwise specified in the contract with TDLR, Contractor must either (i) complete the sanitization and submit via email to the TDLR Contract Manager all sanitization documentation or (ii) submit a written statement via email to the TDLR Contract Manager explaining the reason that destruction of TDLR Information by Contractor is technically impossible or imprac this clause survive the termination or expiration of the contract as long as Contractor retains TDLR Information.

1.8 Secure Erasure of Device Storage Capability. All equipment provided to TDLR by Contractor that is equipped with hard disk drives, solid state device drives, or both (i.e., computers, telephones, printers, fax machines, scanners, multifunction devices, etc.) shall have the capability to securely sanitize data written to the drive prior to final disposition of such equipment, either at the end of the

IST 800-88 guidelines for Media Sanitization.

Approved August 20, 2024. Page 2 of 11

1.9 Electronic and Information Resources Accessibility Standards, 1 TAC §213.17. Contractor represents and warrants that any electronic and information resources products developed, procured, maintained, or used by TDLR directly or used by the Contractor under the contract which requires the use of such product, or requires the use, to a significant extent, of such product in the performance of a service or the furnishing of a product complies with the applicable State of Texas Accessibility requirements for Electronic and Information R

1.10 Cybersecurity Training. Contractor represents and warrants that it will comply with the requirements of Section 2054.5192 of the Texas Government Code relating to cybersecurity training and required verification of completion of the training program.

1.11 Web-Based Remote Access to TDLR Information Systems. Contractor may use third-party web-based remote access connections to TDLR Information Systems to provide support services under the following conditions:

a. TDLR shall affirmatively initiate and accept the connections to TDLR Information Systems.

b. TDLR shall monitor connections to TDLR Information Systems for the duration of the services under any contract that may result from .

c. TDLR shall terminate connections to TDLR Information Systems upon completion of the services.

1.12 Third-Party Service Providers. It is sole responsibility to ensure that its access and the access Contractor grants to its service providers to TDLR Information or TDLR Information Systems does not result in unauthorized access to TDLR Information or TDLR Information Systems.

1.13 Location of TDLR Information. Contractor shall ensure that TDLR Information (i.e., primary and backup) remains, at all times, within the continental United States. Contractor shall receive, process, transmit, and store all TDLR Information within the continental United States. point of access to TDLR Information shall be within the continental United States.

1.14 Encryption Standards. Contractor shall utilize encryption methods, algorithms, keys, and cyphers that are Federal Information Processing Standards (FIPS) 140-3 compliant. Contractor Data in transi

Data at rest means data that is stored in databases, the cloud, removable media, or mobile devices.

1.15 Auditable Information Security Framework. Contractor shall secure its own and its third- (e.g., IT service provider, Cloud Service Provider) in a manner consistent with an auditable information security framework e.g., NIST, ISO 27001.

1.16 System Development Life Cycle. In its Proposal, Contractor shall provide a written description of its system development lifecycle that addresses security engineering methods, software development methods, testing/evaluation/validation techniques, and quality control processes.

1.17 Defects and Vulnerabilities. In its Proposal, Contractor shall disclose product defects and vulnerabilities of any software known to Contractor that allow an attacker to violate an explicit (or implicit) security policy to achieve some impact or consequence. Examples of vulnerabilities include defects that allow intruders to gain increased levels of access or interfere with the normal operations of information systems. Vulnerabilities caused by insecure configurations, design choices, and changing environmental conditions are additional such defects or vulnerabilities.

1.18 Prohibition on Storage of State Material. Contractor acknowledges and agrees that no state material shall be stored on or accessed through a restricted device. This prohibition extends to devices where prohibited technologies are installed, due to concerns about potential data security risks. For the purpose of this prohibition, state material any data, documents, files, or other information related to the operations, administration, or activities of the state; and applications or software deemed by the state to pose potential security risks, including but not limited to TikTok. (See Prohibited Technologies list).

Contractor restricted device is in use or if a prohibited technology installed on any device is used for state activities. TDLR reserves the right to conduct periodic audits to ensure compliance with this provision.

Contractor and Contractor employees must cooperate fully with any such audits and provide access to relevant devices and information as requested.

Violation of this provision may result in the exercise of contractual remedies, up to and including termination of the contract. TDLR reserves the right to pursue legal action against individuals or entities found to be in violation of this provision, particularly if such violations result in the unauthorized disclosure or compromise of state material. This provision may be amended or updated as necessary to address emerging security concerns or changes in relevant laws and regulations. Amendments will be communicated in a timely manner.

Approved August 20, 2024. Page 3 of 11

2.

2.1 Independent Contractor. Contractor acknowledges and agrees that it is furnishing products and services in the capacity of an independent contractor and that Contractor, and its personnel are not employees of TDLR or the State of Texas. TDLR shall not be responsible for withholding taxes from payments made under the Contract. The Contractor shall have no claim against TDLR for vacation pay, sick leave, retirement benefits, social security, worker's compensation, health or disability benefits, itemized travel reimbursement, unemployment insurance benefits, or employee benefits of any kind.

2.2 Contracting Information Responsibilities. In accordance with Section 552.372 of the Texas Government Code, Contractor agrees to: (1) preserve all contracting information related to the contract as provided by the records retention requirements applicable to TDLR for the duration of the contract; (2) promptly provide to TDLR any contracting information related to the contract that is in the custody or possession of the Contractor on request of TDLR; and (3) on termination or expiration of the Contract, either provide at no cost to TDLR all contracting information related to the contract that is in the custody or possession of the Contractor or preserve the contracting information related to the Contract, as provided by the records retention requirements applicable to TDLR. Except as provided by Section 552.374(c) of the Texas Government Code, the requirements of Subchapter J, Chapter 552, Government Code, may apply to the contract and the Contractor agrees that the contract can be terminated if the Contractor knowingly or intentionally fails to comply with a requirement of that subchapter.

2.3 Time Limits. Time is of the essence in the performance of this contract. Contractor shall strictly comply with all of the deadlines and requirements set out in Exhibit A, Statement of Work to this c Contract.

2.4 Insurance and Other Security. Contractor represents and warrants that it will obtain and maintain for the term of the contract all insurance coverage required to ensure proper fulfillment of the contract and its liabilities thereunder. Contractor shall maintain the minimum insurance required by law for any of its motor vehicles used to fulfill its duties under the Contract.

2.5 Media Releases or Pronouncements. Contractor, its employees, representatives, or agents shall not use TDLR other likeness in any press release, marketing material, or other announcement without TDLR TDLR does not endorse any vendor, commodity, or service. Contractor is not authorized to make or participate in any media releases or public announcements pertaining to this Procurement, Contract, Response, or the services to which they relate without TDLR consent, and then only in accordance with explicit written instructions from TDLR.

2.6 Trademark Ownership. Contractor hereby acknowledges and agrees that the trademarks remain the exclusive property of TDLR, that all right, title, and interest in and to the trademarks is exclusively held by TDLR, and all goodwill associated with such trademarks inures solely to TDLR.

2.7 Use of State Property. Contractor is prohibited from using State Property for any purpose other than performing services

R information technology equipment and networks (e.g., laptops, portable printers, cell phones, iPads, tablets, external hard drives, data storage devices, any TDLR-issued software, and the TDLR Virtual Private Network (VPN client)), and any other resources of TDLR. Contractor shall not remove State Property from the continental United States. In addition, Contractor may not use any computing device to access network or e-mail while outside of the continental United States. Contractor shall not perform any maintenance services on State Property unless the contract expressly authorizes such services. During the time that State Property is in the possession of Contractor, Contractor shall be responsible for (i) all repairs and replacement charges incurred by TDLR that are associated with loss of State Property or damaged scope. Contractor shall fully reimburse such charges to TDLR within te State Property for a purpose not authorized by contract shall constitute breach of contract and may result in termination of the contract and the pursuit of other remedies available to TDLR under contract, at law, or in equity.

2.8 Damage to Government Property. Contractor shall be liable for all damage to government-owned, leased, or occupied property and equipment caused by the Contractor and its employees, agents, subcontractors, and suppliers, including any delivery or cartage company, in connection with any performance pursuant to the contract. Contractor shall notify TDLR in writing of any such damage within one (1) calendar day. Contractor is responsible for the removal of all debris resulting from work performed under the Contract.

2.9 Disaster Recovery Plan. Upon request of TDLR, Contractor shall provide the descriptions of its business continuity and disaster recovery plans.

2.10 Limitation on Authority; No Other Obligations. Contractor shall have no authority to act for or on behalf of TDLR or the State of Texas, except as expressly provided for in this Contract; no other authority, power, or use is granted or implied. Contractor may not incur any debt, obligation, expense, or liability of any kind on behalf of TDLR or the State of Texas.

2.11 No Quantity Guarantees. The contract is not exclusive to the Contractor. TDLR may obtain products and related services from other sources during the term of the Contract. TDLR makes no express or implied warranties whatsoever that any particular quantity or dollar amount of products and related services will be procured through the Contract.

Approved August 20, 2024. Page 4 of 11

2.12 Assignments. Contractor shall not assign its rights under the contract or delegate the performance of its duties under the Contract, in whole or in part, without prior written approval from TDLR. Any attempted assignment in violation of this provision is void and without effect.

2.13 No Third-Party Beneficiaries. Nothing contained in the contract, either expressed or implied, is intended to confer on any person other than the Parties, or their respective permitted successors, assigns, transferees, or delegates, any interests, rights, remedies, obligations, or liabilities pursuant to, or by reason of, this contract.

2.14 Subcontractors. Contractor may not subcontract any or all of the work and/or obligations due under the contract without prior written approval of the TDLR. Subcontracts, if any, entered into by the Contractor shall be in writing and be subject to the requirements of the Contract. Should Contractor subcontract any of the services required in the Contract, Contractor expressly understands and acknowledges that in entering into such subcontract(s), TDLR is in no manner liable to any subcontractor(s) of Contractor. In no event shall this provision relieve Contractor of the responsibility for ensuring that the services performed under all subcontracts are rendered in compliance with the Contract.

2.15 Binding Effect.

successor in interest in the Contract. The contract shall inure to the benefit of, be binding upon, and be enforceable against, each Party and their respective permitted successors, assigns, transferees, and delegates.

2.16 Change in Law and Compliance with Laws. Contractor must comply with all laws, regulations, requirements, and guidelines applicable to a Contractor providing services and products required by the contract to the State of Texas and to a Contractor providing professional or similar services to TDLR, as these laws, regulations, requirements, and guidelines currently exist and as they are amended throughout the term of this contract. TDLR reserves the right, in its sole discretion, to unilaterally amend the contract prior to award and throughout the term of the c compliance, as an agency of the State of Texas, with all applicable state and federal laws, regulations, requirements, and guidelines.

2.17 Data Security Breach History. In its Proposal, Contractor must disclose any data security breach incidents, including pertinent, public information describing the breach such as the date of the incident, date of incident discovery, cause of the incident, and remediation efforts undertaken by Contractor.

2.18 Security Incident Notification. Contractor shall have policies and procedures for the effective management of Security Incidents which shall be made available to TDLR upon written request. Within twenty-four (24) hours of discovery or reasonable belief that there has been an event which results in the accidental or deliberate unauthorized access, loss, disclosure, Contractor shall provide notice to TDLR by sending an email to security@tdlr.texas.gov. Until the investigation is complete, Contractor shall submit on a daily basis, or as otherwise directed by TDLR, a written report via encrypted email to security@tdlr.texas.gov which includes, at a minimum, the following:

Date and time incident occurred, Date and time incident detected, Date and time incident contained, Address where the incident occurred, Name of person(s) that discovered incident, Description of how Contractor discovered the incident, Description of the nature of the incident, Description of the steps Contractor has taken or will take to investigate the incident, Description of the steps Contractor has taken or will take to mitigate any negative impacts of the incident, Information technology involved (e.g., laptop, server, mainframe), Description of steps taken to preserve computer evidence and maintain chain of custody, and Description of corrective action Contractor has taken or will take to prevent future incidents.

Contractor shall coordinate all media or other breach notifications with TDLR in advance of such notification(s), unless expressly prohibited by law. Subject to review and approval of TDLR, Contractor shall provide notice at its own cost that satisfies the requirements of applicable law to individuals whose information was compromised or likely compromised as a result of the Security Incident. If TDLR, in its sole discretion, elects to send its own separate notice, then all costs associated with preparing and providing the notice shall be reimbursed to TDLR by Contractor. If Contractor the right to collect such costs. TDLR reserves the right to conduct an independent investigation of any Security Incident, and should TDLR choose to do so, Contractor shall cooperate fully with TDLR and assume responsibility at its own expense for making personnel, resources, orized representative(s).

3. Audits and Records Retention

3.1 The state auditor may conduct an audit or investigation of any entity receiving funds from the state directly under a contract or indirectly through a subcontract under the contract. The acceptance of funds directly under the contract or indirectly through a subcontract under the contract acts as acceptance of the authority of the state auditor, under the direction of the

Approved August 20, 2024. Page 5 of 11 legislative audit committee, to conduct an audit or investigation in connection with those funds. Under the direction of the legislative audit committee, an entity that is the subject of an audit or investigation by the state auditor must provide the state auditor with access to any information the state auditor considers relevant to the investigation or audit.

3.2 Contractor will make available at reasonable times and upon reasonable notice, and for reasonable periods, work papers, reports, books, records, and supporting documents kept current by Contractor pertaining to the contract for purposes of inspecting, monitoring, auditing, or evaluating by TDLR and the State of Texas.

3.3 Records Retention. Contractor shall maintain and retain all records relating to the performance of the contract, including supporting fiscal documents, adequate to ensure that claims for contract funds are in accordance with applicable State of Texas requirements. These records will be maintained and retained by Contractor for a period of seven (7) years after the contract expiration date or until all audit, claim, and litigation matters are resolved, whichever is later.

4. Property Rights

For purposes of the C systems, software, programs, source code, documentation methodologies, concepts, intellectual property, or other property developed, produced, or generated in connection with the services provided under the contract. TDLR and Contractor intend this agreement to be a contract for the services and each considers the Work and any and all documentation or other products and results of the services to be of the Work and any and all documentation or other products and results of the services or any other property of TDLR. Contractor acknowledges and agrees that the Work (and all rights therein) belongs to and shall be the sole and exclusive property of TDLR.

If for any reason the Work would not be considered a work-for-hire under applicable law, Contractor does hereby sell, assign, and transfer to TDLR, its successors and assigns, the entire right, title and interest in and to the copyright in the Work and any registrations and copyright applications relating thereto and any renewals and extensions thereof, and in and to all works based upon, derived from, or incorporating the Work, and in and to all income, royalties, damages, claims and payments now or hereafter due or payable with respect thereto, and in and to all causes of action, either in law or in equity for past, present, or future infringement based on the copyrights, and in and to all rights corresponding to the foregoing. Contractor agrees to execute all papers and to perform such other property rights, as TDLR may deem necessary to secure for TDLR or its designee the rights herein assigned.

In the event that Contractor has any rights in and to the Work that cannot be assigned to TDLR, Contractor hereby grants to TDLR an exclusive, worldwide, royalty-free, irrevocable, and perpetual license to directly and indirectly reproduce, distribute, modify, create derivative works of, publicity perform and publicly display, such rights to make, have made, use, sell and offer for sale any products developed by practicing such rights, and to otherwise use such rights, with the right to sublicense such rights through multiple levels of sublicenses.

hall deliver to TDLR all completed, or partially completed, Work and any and all documentation or other products and results of the services. Failure to timely deliver such Work or any and all documentation or other products and results of the services will be considered a material breach of contract. Contractor will not make or retain any copies of the Work or any and all documentation or other products and results of the services without the prior written consent of TDLR.

5. Indemnification, Liability, Venue, and Dispute Resolution

5.1 INDEMNIFICATION. CONTRACTOR SHALL DEFEND, INDEMNIFY, AND HOLD HARMLESS THE STATE OF TEXAS AND TDLR, AND/OR

THEIR OFFICERS, AGENTS, EMPLOYEES, REPRESENTATIVES, CONTRACTORS, ASSIGNEES, AND/OR DESIGNEES FROM ANY AND ALL LIABILITY, ACTIONS, CLAIMS, DEMANDS, OR SUITS, AND ALL RELATED COSTS, ATTORNEY FEES, AND EXPENSES ARISING OUT OF, OR RESULTING FROM, ANY

ACTS OR OMISSIONS OF CONTRACTOR OR ITS AGENTS, EMPLOYEES, SUBCONTRACTORS, ORDER FULFILLERS, OR SUPPLIERS OF SUBCONTRACTORS

IN THE EXECUTION OR PERFORMANCE OF THE CONTRACT AND ANY PURCHASE ORDER ISSUED UNDER THE CONTRACT. THE DEFENSE SHALL BE

COORDINATED BY CONTRACTOR WITH THE OFFICE OF THE TEXAS ATTORNEY GENERAL WHEN TEXAS STATE AGENCIES ARE NAMED DEFENDANTS

IN ANY LAWSUIT AND CONTRACTOR MAY NOT AGREE TO ANY SETTLEMENT WITHOUT FIRST OBTAINING THE CONCURRENCE FROM THE OFFICE OF

THE TEXAS ATTORNEY GENERAL. CONTRACTOR AND TDLR AGREE TO FURNISH TIMELY WRITTEN NOTICE TO EACH OTHER OF ANY SUCH CLAIM.

5.2 INDEMNIFICATION FOR CONTRACTS INTELLECTUAL PROPERTY MATTERS. CONTRACTOR SHALL DEFEND, INDEMNIFY, AND HOLD

HARMLESS TDLR AND THE STATE OF TEXAS FROM AND AGAINST ANY AND ALL CLAIMS, VIOLATIONS, MISAPPROPRIATIONS, OR INFRINGEMENT

OF ANY PATENT, TRADEMARK, COPYRIGHT, TRADE SECRET, OR OTHER INTELLECTUAL PROPERTY RIGHTS AND/OR OTHER INTANGIBLE PROPERTY, PUBLICITY OR PRIVACY RIGHTS, AND/OR IN CONNECTION WITH OR ARISING FROM: (1) THE PERFORMANCE OR ACTIONS OF CONTRACTOR

PURSUANT TO THIS CONTRACT; (2) ANY DELIVERABLE, WORK PRODUCT, CONFIGURED SERVICE, OR OTHER SERVICE PROVIDED HEREUNDER;

AND/OR (3) TDLR S AND/OR CONTRACTOR S USE OF OR ACQUISITION OF ANY REQUESTED SERVICES OR OTHER ITEMS PROVIDED TO TDLR BY

CONTRACTOR OR OTHERWISE TO WHICH TDLR HAS ACCESS AS A RESULT OF CONTRACTOR S PERFORMANCE UNDER THE CONTRACT.

CONTRACTOR AND TDLR AGREE TO FURNISH TIMELY WRITTEN NOTICE TO EACH OTHER OF ANY SUCH CLAIM. CONTRACTOR SHALL BE LIABLE

TO PAY ALL COSTS OF DEFENSE, INCLUDING ATTORNEY S FEES. THE DEFENSE SHALL BE COORDINATED BY CONTRACTOR WITH THE OFFICE OF

THE TEXAS ATTORNEY GENERAL (OAG) WHEN TEXAS STATE AGENCIES ARE NAMED DEFENDANTS IN ANY LAWSUIT AND CONTRACTOR MAY

NOT AGREE TO ANY SETTLEMENT WITHOUT FIRST OBTAINING THE CONCURRENCE FROM OAG. IN ADDITION, CONTRACTOR WILL REIMBURSE

Approved August 20, 2024. Page 6 of 11

TDLR AND THE STATE OF TEXAS FOR ANY CLAIMS, DAMAGES, COSTS, EXPENSES, OR OTHER AMOUNTS, INCLUDING, BUT NOT LIMITED TO, ATTORNEYS FEES AND COURT COSTS, ARISING FROM ANY SUCH CLAIM. IF TDLR DETERMINES THAT A CONFLICT EXISTS BETWEEN ITS INTERESTS

AND THOSE OF CONTRACTOR OR IF TDLR IS REQUIRED BY APPLICABLE LAW TO SELECT SEPARATE COUNSEL, TDLR WILL BE PERMITTED TO

SELECT SEPARATE COUNSEL AND CONTRACTOR WILL PAY ALL REASONABLE COSTS OF S COUNSEL.

5.3 Patent, Trademark, Copyright, and Other Infringement Claims. Contractor shall indemnify, save, and hold harmless TDLR and the State of Texas from and against claims of violation or infringements of patent, trademark, copyright, trade secret, or other proprietary rights arising from services provided by Contractor to TDLR. TDLR shall notify Contractor of any such claim within a nsel. If Contractor is notified of any such claim Contractor shall notify TDLR within five (5) working days of receiving notice. If TDLR determines that a conflict exists between its interests and those of Contractor or if TDLR is required by applicable law to select separate counsel, TDLR shall be permitted to select separate co any claims, damages, losses, costs, expenses, judgments, or any other amounts, including, but not limited to, attorneys' fees and court costs, arising from any such claim.

5.4 Permits, Certifications, and Licenses. Contractor represents and warrants that it has determined what licenses, patents, certifications, and permits are required under this contract and has acquired all applicable licenses, patents, certifications, and permits.

5.5 No Liability Upon Termination. If this contract is terminated for any reason, TDLR and the State of Texas shall not be liable to Contractor for any damages, claims, losses, or any other amounts arising from or related to any such termination.

5.6 No Implied Waiver. No provision of the contract shall constitute or be construed as a waiver of any of the privileges, rights, defenses, remedies, or immunities available to TDLR as an agency of the State of Texas or otherwise available to TDLR. The failure to enforce or any delay in the enforcement of any privileges, rights, defenses, remedies, or immunities detailed in the contract or otherwise available to TDLR by law will not constitute a waiver of said privileges, rights, defenses, remedies, or immunities or be considered as a basis for estoppel.

5.7 No Waiver of Sovereign Immunity. The Parties expressly agree that no provision of the contract is in any way intended to constitute a waiver by TDLR or the State of Texas of any immunities from suit or from liability that TDLR or the state may have by operation of law.

5.8 Force Majeure. Neither Contractor nor TDLR shall be responsible to the other for any delay in, failure of performance, of any requirement included in the contract caused by force majeure. The existence of such causes of delay or failure shall extend the period of performance until after the causes of delay or failure have been removed provided the non-performing party exercises all reasonable due diligence to perform. Force majeure is defined as acts of God, war, fires, explosions, hurricanes, floods, failure of transportation, or other causes that are beyond the reasonable control of either party and that by exercise of due foresight such party could not reasonably have been expected to avoid, and which, by the exercise of all reasonable due diligence, such party is unable to overcome.

5.9 Limitation of Liability. For any claim or cause of action arising under, in connection with, or related to the Contract, to the extent permitted by the Constitution and the laws of the State, in no event shall either of the Parties be liable to the other for any incidental, indirect, exemplary, punitive, special, or consequential damages, including without limitation loss of revenue, loss of profits, and/or failure to realize benefits, even if it is, or has been, advised of the possibility of such damages, obligations to TDLR hereunder and any violations of state or federal law by Contractor.

5.10 Liquidated Damages. In submitting a Proposal, Contractor agrees that the measure of damages in the event of a default or breach of the contract by Contractor may be difficult or impossible to calculate. In the event Contractor fails to perform Services or complete the obligations under the contract that may result from this solicitation, in a timely manner, TDLR may require Contractor to pay, as liquidated damages and not as a penalty, an amount equivalent to two percent (2%) of the total cost for Services or obligations not completed as required by the contract per calendar day of delay. TDLR may impose, but is not obligated to impose, these liquidated damages in lieu of any monetary damages available to TDLR under the contract or applicable law.

5.11 Cyber Liability. The Contractor will be best positioned to control the manner and means of how the system is implemented and maintained. Therefore, the express intent of the Parties is to hold the Contractor accountable for information security and privacy standards and practices of Contractor organization as they pertain to the scope of this Contract. Therefore, Contractor represents and warrants to comply with, and implement the procedures required under Texas Business and Commerce Code Chapter 521 that include, but are not limited to, notification, costs, crisis management, or data reconstruction resulting from a breach or unauthorized release of TDLR data.

Should Contractor fails to implement the requirements established by this section or if TDLR, in its sole discretion, determines the measures taken or implemented by Contractor, are insufficient to cover the losses, expenses, requirements, and remedies that could include, but are not limited to, notification, costs, crisis management, data reconstruction, or statutory remedies resulting from a data breach under this section, Contractor must the damages incurred from the data breach.

Without waiving other remedies available to TDLR, TDLR may withhold payment to Contractor to offset the expenses required to remedy a data breach under this section.

Approved August 20, 2024. Page 7 of 11

5.12 Information Security Requirements. Contractor shall comply with all applicable state and federal laws and regulations regarding confidentiality, privacy, and security pertaining to confidential TDLR Information. If communications with Contractor necessitate the release of confidential TDLR Information, each individual who will require access to or may be exposed to that information

Data Use Agreement (DUA), a Non-Disclosure Agreement (NDA), or both.

5.13 Governing Law and Venue. The contract shall be governed by and construed in accordance with the laws of the State of Texas, without regard to the conflicts of law provisions. The venue of any suit arising under the contract is fixed in any court of competent jurisdiction of Travis County, Texas, unless the specific venue is otherwise identified in a statute which directly names or otherwise identifies its applicability to TDLR.

5.14 Dispute Resolution. The dispute resolution process provided for in Chapter 2260 of the Texas Government Code must be used to attempt to resolve any dispute arising under the Contract.

6. Notices

Any written notices required under this c contract

General Counsel, 920 Colorado Street, Austin, Texas 78701 or by U.S. mail, certified, return receipt requested, addressed to the appropriate foregoing address for the Contractor, or to P.O. Box 12157, Austin, Texas, 78711. Notice will be effective on receipt by the affected party. Either party may change the designated notice address in this Section by written notification to the other party.

7. Representations and Warranties

7.1 Contractor shall promptly notify TDLR if any representations and warranties provided in this contract are no longer true and correct. The Contractor acknowledges that all its representations and warranties contained in any part of its Proposal and this contract are material and have been relied upon by TDLR in selecting the Contractor for the award of the contract. Further, Contractor warrants and represents that all of its statements and representations made to TDLR prior to being awarded the Contract, and those made during the negotiation of this Contract, are material, true, any laws or regulations. If Contractor performs any work knowing, or having reason to know, that it is contrary to laws or regulations, Contractor shall bear all claims, costs, losses, and damages caused by, arising out of, or resulting therefrom.

7.2 No Conflicts of Interest. Contractor represents and warrants that the provision of goods and services or other performance under the contract will not constitute an actual or potential conflict of interest or reasonably create an appearance of impropriety. If circumstances change during the term of the contract, Contractor agrees to promptly notify TDLR.

7.3 No Felony Criminal Convictions. Contractor represents that neither Contractor nor any of its employees, agents, or representatives, including any subcontractors and employees, agents, or representative of such subcontractors, have been convicted of a felony criminal offense or that if such a conviction has occurred Contractor has fully advised TDLR in writing of the facts and circumstances surrounding the convictions.

7.4 Financial Participation Prohibited Affirmation. Under Section 2155.004, Government Code, the vendor certifies that the individual or business entity named in the response or contract is not ineligible to receive the specified contract and acknowledges that this contract may be terminated, and payment withheld, if this certification is inaccurate.

7.5 Child Support Obligation Affirmation. Under Section 231.006 of the Texas Family Code, Contractor, Vendor, or Applicant certifies that the individual or business entity named in this Contract, bid, or application is not ineligible to receive the specified grant, loan, or payment and acknowledges that this contract may be terminated and payment may be withheld if this certification is inaccurate in addition to other remedies set out in § 231.006(f).

7.6 Debts and Delinquencies Affirmation. Contractor agrees that any payments due under the contract shall be applied towards any debt or delinquency that is owed to the State of Texas.

7.7 Liability for Taxes. Purchases made for State of Texas use are exempt from the State Sales Tax and Federal Excise Tax. TDLR will furnish Tax Exemption Certificates upon request. Contractor represents and warrants that it shall pay all taxes or similar amounts resulting from the contract, including, but not limited to, any federal, State, or local income, sales or excise taxes of Contractor or its employees. TDLR shall not be liable for any taxes resulting from the Contract.

7.8 Contractor Performance. In accordance with Texas Government Code § 2155.074 and § 2155.75, Contractor performance may be used as a factor in the award or continuance of this contract.

7.9 No Suit or Proceeding. Contractor certifies to the best of knowledge and belief, that there are no suits or proceedings pending or threatened against or affecting Contractor, which if determined adversely to Contractor will have a material adverse effect on its ability to fulfill its obligations under the Contract.

7.10 Terminated Contracts. Contractor certifies that it has not had a contract terminated or been denied the renewal of any contract for non-compliance with policies or regulations of any state or federally funded program within the past five (5) years nor is it currently

Approved August 20, 2024. Page 8 of 11 prohibited from contracting with a governmental agency. If Contractor does have such a terminated contract, Contractor shall identify the contract and provide an explanation for the termination.

7.11 Deceptive Trade Practices; Unfair Business Practices. Contractor represents and warrants that it has not been the subject of allegations of Deceptive Trade Practices violations under Texas Business and Commerce Code, Chapter 17, or allegations of any unfair business practice in any administrative hearing or court suit and that Contractor has not been found to be liable for such practices in such proceedings. Contractor certifies that it has no officers who have served as officers of other entities who have been the subject of allegations of Deceptive Trade Practices violations or allegations of any unfair business practices in an administrative hearing or court suit, and that such officers have not been found to be liable for such practices in such proceedings.

7.12 Antitrust Affirmation. The undersigned affirms under penalty of perjury of the laws of the State of Texas that: (1) in connection with this Contract, neither Contractor nor any representative of the Contractor have violated any provision of the Texas Free Enterprise and Antitrust Act, Texas Business & Commerce Code Chapter 15; (2) in connection with this Contract, neither Contractor nor any representative of the Contractor have violated any federal antitrust law; and (3) neither Contractor nor any representative of the Contractor have directly or indirectly communicated any of the contents of the Response or the contract resulting from the Response, if any, to a competitor of the Contractor or any other company, corporation, firm, partnership or individual engaged in the same line of business as the Contractor.

7.13 Prior Disaster Relief Contract Violation. Under Sections 2155.006 and 2261.053 of the Texas Government Code, the Contractor certifies that the individual or business entity named in this Response or contract is not ineligible to receive the specified contract and acknowledges that this contract may be terminated, and payment withheld if this certification is inaccurate.

7.14 Executive Head of a State Agency Affirmation. In accordance with Section 669.003 of the Texas Government Code, relating to contracting with the executive head of a state agency, Contractor certifies that it is not (1) the executive head of TDLR, (2) a person who at any time during the four years before the date of the contract was the executive head of TDLR, or (3) a person who employs a current or former executive head of TDLR.

7.15 Disclosure of Prior State Employment. In accordance with Section 2254.033 of the Texas Government Code, relating to consulting services, Contractor certifies that it does not employ an individual who has been employed by TDLR, or another agency at any time during the two years preceding the submission of the Response or, in the alternative, Contractor has disclosed in its Response the following: (i) the nature of the previous employment with TDLR or the other agency; (ii) the date the employment was terminated; and

(iii) the annual rate of compensation for the employment at the time of its termination.

7.16 Former TDLR Employees. In accordance with Section 2252.901 of the Texas Government Code, Contractor represents and warrants that none of its employees including, but not limited to, those authorized to provide services under the Contract, were former employees of TDLR during the twelve (12) month period immediately prior to the date of execution of the Contract.

7.17 Dealing with Public Servants Affirmation. Contractor has not given, offered to give, nor intends to give at any time hereafter any economic opportunity, future employment, gift, loan, gratuity, special discount, trip, favor, or service to a public servant in connection with the submitted Response.

7.18 Lobbying Prohibition. Contractor

appropriated or other funds under the contract are not prohibited by Sections 556.005 or 556.0055 of the Texas Government Code.

7.19 Entities that Boycott Israel. If Contractor is required to make a certification pursuant to Section 2271.001 of the Texas Government Code, Contractor certifies that Contractor does not boycott Israel and will not boycott Israel during the term of the contract resulting from olicitation. If Contractor does not make that certification, Contractor must indicate that in its Response and state why the certification is not required.

7.20 Buy Texas Affirmation. In accordance with Section 2155.4441 of the Texas Government Code, Contractor agrees that during the performance of a contract for services it shall purchase products and materials produced in Texas when they are available at a price and time comparable to products and materials produced outside this state.

7.21 Foreign Terrorist Organizations. Section 2252.152 of the Texas Government Code prohibits TDLR from awarding a contract to any person who does business with Iran, Sudan, or a foreign terrorist organization as defined in Section 2252.151 of the Texas Government Code. Contractor certifies that it not ineligible to receive the Contract.

7.22 Excluded Parties. Contractor certifies that it is not listed in the prohibited vendors list authorized by Executive Order No. 13224, by the United States Department of the Treasury, Office of Foreign Assets Control.

7.23 Suspension and Debarment. Contractor certifies that it and its principals are not suspended or debarred from doing business with the state or federal government as listed on the State of Texas Debarred Vendor List maintained by the Texas Comptroller of Public Accounts and the System for Award Management (SAM) maintained by the General Services Administration.

Approved August 20, 2024. Page 9 of 11

7.24 E-Verify Program. Contractor certifies that for contracts for services, Contractor shall utilize the U.S. Department of Homeland -Verify system during the term of the contract to determine the eligibility of: (1) all persons employed by Contractor to perform duties within Texas; and (2) all persons, including subcontractors, assigned by Contractor to perform work pursuant the contract within the United States of America.

7.25 Civil Rights Act. Contractor represents and warrants that it shall comply with the Civil Rights Act. Contractor agrees that no person shall, on the grounds of race, color, religion, sex, national origin, age, disability, political affiliation, or religious belief, be excluded from the participation in, be denied the benefits of, be subjected to discrimination under, or be denied employment in the administration of, or in connection with, any program or activity funded in whole or in part with funds available under this Contract. The Contractor shall comply with Executive Order 11246, "Equal Employment Opportunity," as amended by Executive Order 11375, "Amending Executive Order 11246 relating to Equal Employment Opportunity," and as supplemented by regulations at 41 C.F.R. Part 60, "Office of Federal Contract Compliance Programs, Equal Employment Opportunity Department of Labor."

7.26 Americans with Disabilities Act. Contractor represents and warrants that it shall comply with the requirements of the Americans with Disabilities Act (ADA), and its implementing regulations, as each may be amended.

7.27 COVID-19 Vaccine Passport Prohibition. Contractor certifies that it does not require its customers to provide any

-19 vaccination or post-transmission recovery on entry to, to gain access to, or to receive ent would make Contractor ineligible for a state-funded Contract.

7.28 Critical Infrastructure Affirmation. Pursuant to Government Code Section 2275.0102, Contractor certifies that neither it, nor its parent company, nor any affiliate of Contractor or its parent company, is: (1) majority owned or controlled by citizens or governmental entities of China, Iran, North Korea, Russia, or any other country designated by the Governor under Government Code Section 2275.0103, or (2) headquartered in any of those countries.

7.29 Firearm Entities and Trade Associations Discrimination. If Contractor is required to make a verification pursuant to Section

2274.002 of the Texas Government Code, Contractor verifies that it (1) does not have a practice, policy, guidance, or directive that discriminates against a firearm entity or firearm trade association and (2) will not discriminate during the term of the contract against a firearm entity or firearm trade association. If Contractor does not make that verification, Contractor must indicate it in its Response and state why the verification is not required.

7.30 Energy Company Boycott. Contractor represents and warrants that: (1) it does not, and will not for the duration of the Contract, boycott energy companies or (2) the verification required by Section 2276.002 of the Texas Government Code does not apply to the Contract. If circumstances relevant to this provision change during the term of the Contract, Contractor shall promptly notify TDLR.

7.31 Human Trafficking Prohibition. Under Section 2155.0061 of the Texas Government Code, the Contractor certifies that the individual or business entity named in its Response, or the contract, is not ineligible to receive the specified contract and acknowledges that this contract may be terminated, and payment withheld if this certification is inaccurate.

7.32 Prohibited Transactions. Contractor represents and warrants that the contract is not a taxpayer resource transaction prohibited appropriated funds under the contract are not prohibited by Article IX, Section 6.24 of the General Appropriations Act.

7.33 Prompt Payment. Payment shall be made in accordance with Chapter 2251 of the Texas Government Code, commonly known as the Texas Prompt Payment Act. Chapter 2251 of the Texas Government Code shall govern remittance of payment and remedies for late payment and non-payment.

7.34 Discounts. If Contractor at any time during the term of the contract provides a discount on the final contract costs, Contractor will notify TDLR in writing ten (10) calendar days prior to effective date of discount. TDLR will generate a Purchase Order Change Notice and send a revised Purchase Order to Contractor.

7.35…