Exhibit A - SOW - RFP AADA 2027-0046 ACP Client Data Removal Services.pdf

Exhibit A 1

DPA Solicitation No.:

RFP AADA 2027-0046

ACP CLIENT DATA REMOVAL SERVICE

EXHIBIT A – STATEMENT OF WORK

Exhibit A 2

SECTION 1.0 GENERAL INFORMATION

1.1. Introduction

1.1.1. The Colorado Department of Personnel & Administration (Department), Address

Confidentiality Program (ACP), is soliciting firms (Contractor) to provide automated, recurring, and comprehensive data removal services (Services) to protect the privacy of active ACP participants. The ACP provides survivors of domestic violence, sexual offenses, stalking, and harassment with a legal substitute address for use with State and local government agencies and a confidential mail forwarding service.

1.1.2. The initial term of the contract (Contract), and every term, thereafter, is contingent upon receiving grant funding for each of the given years.

1.1.3. The ACP has been awarded a grant in the amount of $108,000; therefore, this will be the

2027 annual budget for the initial Contract term.

1.2. Background

1.2.1. Many ACP participants cannot relocate before or immediately after enrollment due to financial hardship, economic abuse, or systemic barriers. Consequently, their actual physical residential addresses and other personally identifiable information (PII) remain exposed across hundreds of online people-search engines and data broker registries, significantly compromising the protection provided by their substitute address.

1.2.2. To mitigate these risks, the ACP is sponsoring automated data removal subscriptions for active ACP participants. The goal of this project is to systematically eliminate participants' location data from publicly available search platforms, restoring their online security and reducing their exposure to physical harm.

1.3. Anticipated Contract Term

1.3.1. The initial term of the awarded Contract is expected to begin on January 1, 2027 and end on December 31, 2027.

1.3.2. The final issuing of a contract resulting from this solicitation is dependent upon the

Department receiving grant funds that it has applied for. A final determination regarding grant funding is anticipated in October, 2026. In the event that funding is not received, the Department will be unable to enter into a contract.

1.3.3. The total duration of the Contract, from the Start Date until termination, and including the Department’s exercise of any options, is not anticipated to exceed five (5) years. The

Department may extend the Contract beyond the anticipated term in this subsection, in accordance with the Colorado Procurement Code and its implementing rules, in the event

Exhibit A 3 that the Department determines the extension is necessary to align the Contract with other Department contracts; to address State programmatic or policy changes related to the Contract or to provide sufficient time to transition the Work.

1.3.4. The Department may, at its sole discretion, choose to not exercise any option or Extension

Term in the Contract for any reason. Should the Department forgo an Extension Term, it reserves the right to re-procure Services at its sole discretion.

1.4. Terminology

1.1.1. In addition to the terms defined in §5 of the Contract, acronyms and abbreviations are defined at their first occurrence in this Exhibit A - Statement of Work. The following list of terms shall be construed and interpreted as follows:

1.1.1.1. Data Broker – Any commercial entity or website that aggregates, packages, and sells or displays individuals' personally identifiable information (PII) publicly online.

1.1.1.2. Deliverable - any tangible or intangible object produced by Contractor as a result of

Services that are intended to be delivered to the State, regardless of whether the object is specifically described or called out as a “Deliverable” or not.

1.1.1.3. Key Personnel - The position or positions that are specifically designated as such in the

Contract.

1.1.1.4. Other Personnel - Individuals and subcontractors, in addition to Key Personnel, assigned to positions to complete tasks associated with Services.

1.1.1.5. Participant (or Subscriber) - An active enrollee of the Colorado Address Confidentiality

Program (ACP) authorized by the Department to receive sponsored Services.

1.1.1.6. Personally Identifiable Information (PII) - Highly sensitive information including full names, aliases, current/historical physical addresses, phone numbers, personal emails, known relatives, and associated property or personal photos.

SECTION 2.0 OFFEROR’S EXPERIENCE AND PERSONNEL

2.1. Accessibility Requirements

2.1.1. All Services performed as a result of this solicitation must comply with all applicable provisions of §§24-85-101, et seq., C.R.S., and the Accessibility Standards for Individuals with a Disability, as established by the Office of Information Technology pursuant to

Section §24-85-103 (2.5), C.R.S. and 3) all State of Colorado technology standards related to technology accessibility and with Level AA of the most current version of the Web

Content Accessibility Guidelines (WCAG), incorporated in the State of Colorado technology standards.

Exhibit A 4

2.2. Organizational Experience

2.2.1. The State requires Contractor to possess specific skills and experience to ensure Services are completed efficiently and within the Department's deadlines.

2.2.2. The State will evaluate Contractor experience pertaining to the following:

2.2.3. A documented operational history demonstrating the infrastructure, capacity, and resources required to ensure effective data deletion and secure data management.

2.3. Personnel Requirements

2.3.1. Key Personnel requirements:

2.3.1.1. Project Lead

The Project Lead shall be responsible for all of the following:

2.3.1.1.1. Serving as Contractor’s primary point of contact for the State.

2.3.1.1.2. Ensure the complete, accurate, and timely delivery of all Services in strict compliance with Contract requirements.

2.3.1.1.3. Overseeing all additional Key Personnel and Other Personnel and ensuring proper staffing levels throughout the term of the Contract.

2.3.2. Additional Personnel requirements:

2.3.2.1. Other than the Key Personnel designated above, Contractor may propose any other personnel and structure that it believes is most efficient and effective at completing

Services.

2.3.2.2. Contractor shall not allow any individual to fill more than one of the roles defined as Key

Personnel.

SECTION 3.0 PROJECT SPECIFIC STATEMENT OF WORK

3.1. Overview and Objectives

3.1.1. Contractor shall provide Services to protect the privacy of active ACP participants. The service must systematically scan, identify, and remove participants' PII from online registries while ensuring strict data security.

3.1.2. Subscriptions are currently provided to 1,350-1,400 participants.

3.2. Core Technical Requirements

3.2.1. Contractor shall meet or exceed the following performance standards and functional requirements:

3.2.1.1. Registry Coverage and Scanning Depth

Exhibit A 5

3.2.1.1.1. Contractor shall continuously scan and monitor a broad library of data brokers and public "people search" engines (e.g., Whitepages, Spokeo, BeenVerified, Radaris, MyLife).

3.2.1.2. Deletion efforts must cover all forms of location-revealing information and identifying

PII, including full names, aliases, current/historical physical addresses, phone numbers, personal emails, known relatives, and associated property or personal photos.

3.2.1.3. Contractor shall identify and execute removals on data broker sites originating outside the United States where legally permissible.

3.2.2. Automated and Manual Takedown Frequency

3.2.2.1. Because data brokers continuously scrape new data, Contractor shall execute automated, recurring sweeps and subsequent deletion requests for each participant at minimum intervals of every 30 to 90 days.

3.2.2.2. Contractor shall utilize a secure, standardized onboarding process (such as a limited

Power of Attorney or automated "Do Not Sell" requests under applicable State laws) to legally act on the participant's behalf to demand removal.

3.2.2.3. Contractor shall define clear escalation workflows (e.g., repeated outreach, manual agent submission, legal notifications) in instances where data brokers ignore initial removal requests.

3.2.3. Data Security and Privacy Standards

3.2.3.1. Contractor is strictly prohibited from selling, renting, or leveraging any participant information collected during onboarding or scanning for marketing, profiling, or monetization.

3.2.3.2. All data collected to establish subscriber accounts must be stored in a highly secure, encrypted environment using industry-standard protocols (e.g., AES-256) to protect this vulnerable population.

3.2.4. Participant Experience and Dashboard Features

3.2.4.1. Contractor must provide each participant with an individual, secure online portal to view real-time removal progress.

3.2.4.2. The portal must display to participants:

3.2.4.2.1. The names of scanned websites and registries.

3.2.4.2.2. The status of each removal request (e.g., Found, Pending Removal, Successfully

Removed).

3.2.4.2.3. Estimated timeframes for remaining pending removals.

Exhibit A 6

3.2.4.3. For registries requiring physical verification or direct user signatures, Contractor shall provide clear, integrated DIY instructions within the portal so participants can finalize those specific removals.

3.3. Reporting and Program Deliverables

3.3.1. To satisfy program evaluation and compliance requirements, Contractor shall provide regular, programmatic data.

3.3.2. Quarterly Program Metrics: Contractor shall deliver quarterly reports to the ACP Program

Manager detailing:

3.3.2.1. Names of participants who are subscribed to the service.

3.3.2.2. Total Subscriptions Opened: Cumulative number of active participant accounts established.

3.3.2.3. Volume of Data Removed: The total estimated number of registry profiles/records successfully expunged across the participant pool.

3.3.2.4. Removal Efficiency Rate: Average time elapsed between identifying a record and confirming its removal.

3.3.2.5. Any other data required for quarterly grant reporting.

3.4. ACP Administration & Referral Process

3.4.1. Direct-to-Participant Engagement

3.4.1.1. Contractor shall establish a secure, simple registration process specifically for ACP participants to sign up directly (e.g., through a dedicated, co-branded portal or landing page).

3.4.2. State-to-Contractor Referral Verification

3.4.2.1. Contractor shall work with ACP staff to develop a secure mechanism (such as unique referral codes or secure file exchanges) to verify that registering individuals are active, eligible ACP participants before activating sponsored subscriptions.

SECTION 4.0 Compensation and Invoicing

4.1. Pricing and Billing

4.1.1. All fees for participant subscriptions shall be billed directly to the Department. No participant shall be charged or required to input financial information to activate or maintain their sponsored subscription.

4.1.2. Proposed pricing shall remain firm for the duration of the initial contract term.

4.1.3. Contractor shall clarify whether fees are structured on a flat annual rate, a monthly per-participant basis, or an alternative bulk-licensing model.

Exhibit A 7

4.1.4. Fees must encompass all administrative overhead, technical support, and the required quarterly programmatic reporting to the Department with no hidden charges.

4.2. Detailed Invoicing and Payment Procedures

4.2.1. Contractor shall invoice the State on a monthly basis, by the 15th Business Day of the month following the month for which the invoice covers. Contractor shall not invoice the

State for a month prior to the last day of that month.

4.2.2. The invoice shall contain all of the following for the month for which the invoice covers:

4.2.2.1. The number of active, verified subscriptions managed during the billing period, while strictly maintaining participant anonymity (utilizing unique ID codes or aggregate license counts rather than participant names or addresses).