Exhibit_A_PO-Terms-Conditions-IT-Version-1-15-19-Without-Initial-Sig-Blocks.pdf

Canaveral Port Authority (CPA)

PURCHASE ORDER TERMS AND CONDITIONS

INCLUDES DATA HANDLING, SECURITY AND PRIVACY REQUIREMENTS

Rev 1/15/19 Page1 of 3

The following terms and conditions are applicable to this order entered into by and between the Canaveral Port Authority (referred to as Buyer) and Vendor (referred to as Seller).

MODIFICATIONS No modifications of this order shall be binding upon Buyer unless approved in writing by Buyer or authorized representative of Buyer. Quantities specified in the order cannot be changed without Buyer approval. Goods shipped in excess of quantity designated may be returned at Seller’s expense.

ASSIGNMENT Any assignment of this order, performance of work hereunder, in whole or in part, or monies due to become due hereunder, shall be void unless consented to by Buyer in writing and Buyer shall have no obligations to any assignee of Seller under any assignment not consented to in writing by Buyer.

TERMINATION Buyer reserves the right to terminate this order in whole or in part for default if Seller fails to perform in accordance with any of the requirements of this order. Any such termination will be without liability to Buyer except for completed items delivered and accepted by the Buyer. At any time during the term of this order at Buyer’s written request, or upon the termination or expiration of this order for any reason, Seller shall, and shall instruct all authorized employees and subcontractors to, promptly and securely return or destroy any and all Personally Identifiable Information (PII), whether in written, electronic or other form of media.

F.O.B. In those cases where prices stated are not F.O.B. destination, Seller is required to prepay charges and list on invoice.

C.O.D. No C.O.D shipments will be accepted.

TERMS By accepting this order, the Seller agrees that payment terms shall be Net 30 days unless otherwise stated. Payment will be made in accordance with Buyer’s policies and procedures.

INVOICING Seller must render an original invoice in duplicate to the Finance Department address stated on the front of this order.

TAX Buyer is exempt from Federal and State taxes for tangible personal property. Sellers doing business with the Buyer may not be exempt from paying sales tax to their suppliers for materials to fulfill contractual obligations with the Buyer, nor shall any Seller be authorized to use the Buyer’s Tax Exemption number in acquiring such materials.

ORDER NUMBER Order number must appear on all invoices, packing slips, shipping notices, freight bills and correspondence concerning this order.

COMPLIANCE

A. Seller shall observe and comply with all Federal, State, local and municipal laws, ordinances rules and regulations that would apply to this order/contract.

B. Seller shall comply, when applicable, with the provisions set forth by the “Contract Work Hours and Safety Standards Act” (40 U.S.C. 327-330) as supplemented by U.S. Department of Labor (29 CFR Part 5).

C. Seller shall provide access to pertinent records relative to order/contract for a period of three (3) years after the last receipt of payment is made under this order/contract, whichever occurs last.

D. If Seller has access to or will collect, access, use, store, process, dispose of or disclose credit, debit or other payment cardholder information, Seller shall at all times be in compliance with the Payment Card Industry Data Security Standard (“PCI DSS”) requirements, including promptly implementing all procedures and practices to remain compliant with PCI DSS at Seller’s sole cost and expense.

INSPECTION All commodities delivered on this order are subject to inspection upon receipt by a representative of the Buyer. All rejected commodities shall remain the property of the Seller and will be returned at Seller’s expense.

LITIGATION VENUE The parties waive the privilege of venue and agree that all litigation between them in the state courts shall take place in the 18th Judicial Circuit in and for Brevard County, Florida, and that all litigation between them in the federal courts shall take place in the U.S. District Court in and for the Middle District of Florida.

PAYMENT CHANGES Payments will only be made to the company and address as set forth on order unless the Seller has requested a change thereto on official company letterhead, signed by an authorized officer of the company and approved by an authorized official for Buyer.

ANTI-DISCRIMINATION Sellers doing business with Buyer are prohibited from discriminating against any employee, applicant or client because of race, creed, color, national origin, sex or age, with regard to, but not limited to, the following: employee practices, rates of pay or other compensation methods and training selection.

UNIFORM COMMERCIAL CODE The Uniform Commercial Code (Florida Statutes, Chapter 672) shall prevail as the basis for contractual obligations between the Seller and Buyer for any terms and conditions not specifically stated in this order.

LEGAL RESPONSIBILITY By accepting this order, Seller understands and agrees that the items covered herein, or services to be rendered, shall be manufactured, sold or performed in compliance with applicable Federal, State, County and local laws, statutes, ordinances, rules and regulations. Lack of knowledge by the Seller shall in no way be a cause for relief from responsibility.

Rev 1/15/19 Page2 of 3

LIABILITY-COPYRIGHT/PATENT/TRADEMARK Sellers shall save and hold harmless Buyer, its employees and agents from liability for infringement of any United States patent, trademark or copyright for or on account of the use of any product sold to Buyer or used in the performance of this order.

INSURANCE If the Seller is required to go on Buyer’s property to perform work or services, the Seller shall assume full responsibility and expense to obtain all necessary insurance as required by Buyer.

INDEMNIFICATION To the extent authorized by law, Seller shall indemnify, save and hold harmless Buyer, its employees and agents against any and all claims, damages, liability and court awards including costs, expenses and attorney fees incurred as a result of any act or omission by the Seller, or its employees, agents, subcontracts or assignees pursuant to the terms of this order.

OCCUPATION SAFETY AND HEALTH Seller compliance required under Chapter 442, Florida Statutes, that any toxic substance delivered as a part of this order must be accompanied by a Material Safety Data Sheet (MSDS).

REPRESENTATIVES All parties to the order agree that the representatives’ names herein are, in fact, bona fide and possess full and complete authority to bind said parties.

CONFIDENTIAL INFORMATION Florida law provides that agency records shall at all times be open for personal inspection by any person. s.119.01, F.S., “The Public Records Law”. Information and materials received by Buyer in connection with all Sellers’ response shall be deemed to be public records subject to public inspection in accord with Chapter 119 F.S. However, Florida law provides for certain exemptions to its public records law. Therefore, if the Seller believes any of the information contained in his or her response is exempt from Florida’s public records law, then the Seller must in his or her response, specifically identify the material which is deemed to be confidential or exempt and cite the legal authority for the exemption; otherwise, Buyer will treat all materials received as public records.

E- VERIFY All Sellers shall be advised that upon negotiations and subsequent contract execution (the “Contract”), the Buyer shall utilize the U.S. Department of Homeland Security’s E-Verify system, in accordance with the terms governing use of the system, to confirm the employment eligibility of:

1. all persons employed by the Buyer during the term of the Contract to perform employment duties within Florida; and

2. all persons, including subcontractors, assigned by the Buyer to perform work pursuant to the Contract between Buyer and the selected Seller.

ORDER OF PRECEDENCE If order is pursuant to a specific contract, solicitation or bid, the terms and conditions of that contract, solicitation or bid will supersede purchase order terms and conditions, but only when there is conflict between the two.

DATA HANDLING, SECURITY AND PRIVACY REQUIREMENTS:

Authorized Access At a minimum, Seller’s safeguards for the protection of PII shall include: Limiting access of PII to authorized employees and subcontractors; (2) securing business facilities, data centers, paper files, servers back-up systems and computing equipment, including but not limited to all mobile devices and other equipment with information storage capability; (3) implementing network, device, application, database and platform security; (4) securing information transmission, storage and disposal; (5) implementing authentication and access controls within media, applications, operating systems and equipment; (6) Encrypting PII transmitted over public or wireless networks; (7) strictly segregating PII from information Seller or its other customers so data is not comingled; (8) implementing appropriate personnel security and integrity procedures and practices, including but not limited to, conducting background checks consistent with applicable law; and (9) providing privacy and information security training to Seller’s employees and subcontractors.

Unauthorized Disclosure: Seller agrees and covenants that it shall:

A. Keep and maintain all PII in strict confidence, using such degree of care as is appropriate to avoid unauthorized access, use or disclosure;

B. Use and disclose PII solely and exclusively for the purpose for which the PII, or access to it, is provided pursuant to the terms and conditions of this agreement;

C. Not use, sell, rent, transfer, distribute, or otherwise disclose or make available PII for Seller’s own purposes or for the benefit of anyone other the Buyer; and

D. Not transfer any PII to or from different countries without the express prior written consent of the Buyer.

Data Breach Notification Seller agrees and covenants that it shall notify Buyer of an actual or potential Security Breach as soon as practicable, but no later than one business day after the Seller becomes aware of an actual or potential Security Breach and that notification will be done with a live person and not via email or voicemail.

Audit Rights Upon Buyer’s written request and no less than one month following such written request, Seller shall permit Buyer to conduct or oversee an audit of Seller’s facilities and practices to confirm compliance with this order as well as any applicable laws and industry standards. Seller is not required to permit Buyer to conduct or oversee more than one audit per calendar year, unless there has been an actual or potential Security Breach.

Rev 1/15/19 Page3 of 3

Personally Identifiable Information (PII) is defined as information: (i) that directly identifies an individual or (ii) by which an agency intends to identify specific individuals in conjunction with other data elements.

The National Institute of Standards and Technology (NIST) defines PII as: Full name, Face (sometimes), Home address, Email address, National identification number (e.g., Social Security number in the U.S.), Passport number, Vehicle registration plate number, Driver's license number, Face, fingerprints, or handwriting, Credit card numbers, Digital identity, Date of birth, Birthplace, Genetic information, Telephone number, Login name, screen name, nickname, or handle.

The European Unions’ General Data Protection Regulation (GDPR) defines personal data as: Any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

GDPR would only apply to captured, stored or processed personal information for a resident/citizen of the EU such as employee or vendor data. If GDPR does apply, the definition of personal data extends to include things like:

First name or first initial + last name, Physical address, E-mail address, Telephone number, Date of birth, Username, Social security number, Driver’s license number/state ID card number, Passport number, License plate number, Account number/credit or debit card number, Employee ID number, Biometric data (e.g., fingerprint, facial geometry, voice recognition, etc.), Photograph, video or audio file (of individual), Social media account credentials/identifiers, Any information that provides a precise geolocation of an individual (e.g., GPS, latitude/longitude coordinates, IP address location, zip+4, etc.), Any individually identifiable information regarding medical history, treatment or diagnosis by a health care professional, or payment for health services, Any device ID or other persistent identifier, IP address.

GDPR further extends personal data to a special category of data that may need special attention such as:

Children’s data, Political Affiliation or opinion, Sexual Orientation, Commission or Alleged commission of a crime, Trade union membership, Genetic or Biometric data, Racial or Ethnic, Physical or Mental Health or Condition, Religious Belief.

https://en.wikipedia.org/wiki/Fingerprint

Compliance