Exhibit B Data Protection Addendum (DPA).pdf

Agreement number:

ADDENDUM D - DATA PROTECTION ADDENDUM

This Data Protection Addendum (“DPA”) is by and between ________________________ (“Contractor”) and the Board of Trustees of the Colorado School of Mines, for and on behalf of the Colorado School of Mines (“Mines”) and applies to all Services provided by Contractor for Mines pursuant to the contract between Contractor and Mines dated _____________ (“Contract”). This DPA modifies the Contract solely with regard to the subject matter set forth herein, and to the extent any such addition, deletion, or modification results in any conflict or inconsistency between the Contract and this DPA, the terms of this DPA shall govern.

In consideration of the mutual covenants and promises contained herein, the Parties agree to amend the Contract as follows:

1. Definitions

1.1. "Confidential Information" means data, information, and Records, regardless of form, including but not limited to: (a) Mines Data; (b) specifications, data, standards, records, and other information relating to Mines' information technology; and (c) any other information of Mines that is not subject to disclosure under the Colorado Open Records Act.

1.2. “Education Records” means records, files, documents, and other materials that (a) contain information directly related to a student, and (b) are maintained by Mines, or by a party acting for Mines, such as Contractor.

1.3. “Incident” means any accidental or deliberate event that results in or constitutes a suspected, attempted, or imminent threat of unauthorized access, use, loss, disclosure, modification, disruption, destruction, or compromise to, of, or involving Mines Data. Incidents include, without limitation, (a) successful attempts to gain unauthorized access to Mines Data regardless of where such information is located, (b) unwanted disruption or denial of service; or (c) the release or disclosure of any data that is not properly de-identified or aggregated.

1.4. “Mines Data” means any Personally Identifiable Information, Record, Education Record, Research Record, Personnel Record, and all Personally Identifiable Information included therein or derived therefrom that is not intentionally made generally available by Mines on public websites or publications but is made by Mines, directly or indirectly, to Contractor or that is otherwise collected or generated by Contractor in connection with the performance of the Services.

1.5. “Personnel Records” means and includes home addresses, telephone numbers, financial information, a disclosure of an intimate relationship filed in accordance with the policies of Mines, other information maintained because of the employer-employee relationship, and other documents specifically exempt from disclosure under part 2 of the Colorado Open Records Act, C.R.S. § 24-72-101 et seq., or any other applicable law.

1.6. “Personally Identifiable Information” or “PII” means information and metadata that, alone or in combination, is linked or linkable to a specific individual so as to allow a reasonable person in the community, who does not have personal knowledge of the relevant circumstances, to identify that individual with reasonable certainty. Personally Identifiable Information includes but is not limited to: (a) the individual’s name; (b) the names of the individual’s parent, spouse, or other family members; (c) the address or phone number of the individual or individual’s family; (d) personal identifiers such as a state- or university-assigned student identifier, social security number, student or employee number, or biometric records; (e) indirect identifiers such as the individual’s date of birth, place of birth, or mother’s maiden name; and (f) demographic attributes, such as race, socioeconomic information, sex, gender, and gender identity. To the extent not already included in the definition above, PII also includes, but is not limited to, all information defined as personally identifiable information in § § 24-72-501 and 24-73-103, as well as “personal identifying information” as defined in the Colorado Open Records Act, C.R.S.

§ 24-72-102 et seq.; personally identifiable information contained in student “education records” as that term is defined in the Family Educational Rights and Privacy Act, 20 U.S.C. 1232g;

“protected health information” as that term is defined in the Health Insurance Portability and Accountability Act, 45 C.F.R. Part 160.103; “nonpublic personal information” as that term is defined in the Gramm-Leach-Bliley Financial Modernization Act of 1999, 15 U.S.C. 6809;

credit and debit card numbers and/or access codes and other cardholder data and sensitive authentication data as those terms are defined in the Payment Card Industry Data Security Standards; other financial account numbers, access codes, and state- or federal-identification numbers such as driver’s license, passport, or visa numbers.

1.7. “Record” means any information recorded in any way, including, but not limited to, handwriting, print, digital and electronic media, video or audio tape, film, microfilm, and microfiche.

1.8. “Research Records” means records, files, documents, and other materials that contain information that has been collected, observed, generated, or created to validate original research findings.

1.9. “Securely Destroy” means to remove Mines Data from Contractor’s systems, paper files, records, databases, and any other media regardless of format, in accordance with the standard detailed in National Institute of Technology (“NIST”) SP 800-88 Guidelines for Media Sanitization so that Mines Data is permanently irretrievable in Contractor’s and Subcontractor’s normal course of business.

1.10. “Security Breach” means an event in which Mines Data is exposed to unauthorized disclosure, access, alteration or use or a system configuration that results in a documented unsecured disclosure, access, alteration or use, in a manner not permitted in this DPA, which poses a significant risk of financial, reputation, or other harm to the affected individuals or Mines.

1.11. “Services” has the meaning set forth in the Contract.

1.12. “Subcontractor” means Contractor’s subcontractors, or agents, identified on Schedule 1, as updated by Contractor from time to time in accordance with the requirements of this DPA, who Contractor has engaged to enable Contractor to perform its obligations under the Contract.

2. Rights and License in and to the University Data

Mines owns all rights, title, and interest in and to Mines Data and any and all now known or hereafter existing intellectual property rights associated therewith, and any derivative works thereof or modifications thereto. Mines hereby grants to Contractor a limited, nonexclusive license to use Mines Data solely for the purpose of performing its obligations as specified in the Contract or as otherwise permitted by this DPA. Contractor shall have no rights, title, or interest implied or otherwise, to Mines Data, except as expressly stated in the Contract or this DPA.

3. Data Privacy

3.1. Use of Mines Data. Contractor shall, and shall cause its Subcontractors, to use Mines Data only for the purpose of performing the Services and fulfilling its duties under the Contract.

3.2. Prohibited Uses of Mines Data. Contractor shall not:

a) Use, sell, rent, transfer, distribute, or disclose Mines Data (including metadata) to any third party without the prior written consent of Mines, except as may be required by law;

b) Modify, alter, translate, search, analyze, extract, or otherwise mine or scan Mines Data, including metadata, unless otherwise permitted by Mines in writing.

c) Use Mines Data for its own commercial benefit, including but not limited to, advertising or marketing of any kind directed toward Mines' students or Mines’ employees, or their families, unless such use is specifically authorized by the Contract or this DPA or otherwise authorized in writing by Mines;

d) Use Mines Data in a manner that is inconsistent with Contractor’s privacy policy;

e) Use Mines Data to create a personal profile of a student or employee, except as expressly authorized by Mines under the Contract, or with the express consent of the student (if over the age of 18), the student's parent or legal guardian, or the employee.

f) Allow remote access to Mines Data from outside the United States, including access by Contractor's employees or agents, without the prior express written approval of Mines, which may be denied by Mines in its sole discretion;

g) Disclose or share any PII contained within Mines Data to third parties for the purpose of investigating for, participating in, cooperating with, or assisting with Federal immigration enforcement, unless required by federal or state law or to comply with a court-issued subpoena, warrant, or order, subject to Section 7;

h) Store Mines Data outside the continental United States without the prior express written consent of Mines; and

i) Permit Subcontractors to engage in any of the prohibited uses and activities specified in this Section 3.2.

3.3. Qualified FERPA Exception. If Contractor will have access to Education Records, Contractor acknowledges that for the purposes of the Contract and this DPA, pursuant to the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g and its implementing regulations, 34 C.F.R. Part 99 (“FERPA”), Contractor shall be deemed a "school official," as defined under FERPA. Such Education Records are subject to the FERPA non-disclosure requirements and are considered confidential under the Contract and this DPA. Contractor shall not use Education Records for any purpose other than in performance of the Contract and in compliance with this DPA. Contractor shall ensure that access to Education Records is limited to those employees of

Contractor that are essential to the performance of the Contract and this DPA. Any Education Records held or stored by Contractor will be made available to Mines upon request.

3.4. Subcontractor Use of Mines Data. To the extent necessary to perform its obligations specified in the Contract, Contractor may disclose Mines Data to Subcontractors pursuant to a written agreement, specifying the purpose of the disclosure and providing that: (a) Subcontractor shall not disclose Mines Data, in whole or in part, to any other party; (b) Subcontractor shall not use any Mines Data to advertise or market to Mines' students or employees or their families; (c) Subcontractor shall access, view, collect, generate, and use Mines Data only to the extent necessary to assist Contractor in performing its obligations specified in the Contract; (d) at the conclusion of its/their work under its/their subcontract(s), Subcontractor shall, as directed by Mines through Contractor, Securely Destroy all Mines Data in its/their possession, custody, or control, or return such Mines Data to Mines, at the election of Mines; and (e) Subcontractor shall utilize appropriate administrative, physical, and technical safeguards no less rigorous than those prescribed by the Center for Internet Security Critical Security Controls framework, and which additionally meet all regulatory compliance standards set forth for the respective data or records in the scope of this Agreement to secure Mines Data from unauthorized disclosure, access, and use. Contractor shall require that its employees and Subcontractors who have potential access to Mines Data enter into a confidentiality agreement with Contractor that is no less restrictive than the requirements set forth in this DPA and the Contract before any access to the Mines Data is granted.

4. Data Security, Integrity, and Confidentiality

4.1. Data Security. Contractor shall provide for the security of Mines Data and shall implement security controls no less rigorous than those prescribed by the Center for Internet Security Critical Security Controls framework, and which additionally meet all applicable legal and regulatory compliance standards and controls set forth for the respective data or records in scope of this Contract, including without limitation, Mines' non-disclosure requirements, use of appropriate technology, security practices, computer access security, data access security, data storage encryption, data transmission encryption, security inspections, network firewalls, intrusion detection (host and network), data security logging and monitoring systems, and audits.

Contractor shall be deemed a "Third-Party Service Provider" as defined in C.R.S. § 24-73- 103(1)(i) and shall maintain security procedures and practices consistent with C.R.S. §§ 24-73- 101 et seq., as amended. Contractor shall use reasonable, appropriate industry-standard and up-to-date security tools and technologies in providing the Services under the Contract. Contractor shall cause its Subcontractors to adhere to the requirements set forth in this section.

4.2. Data Integrity. Contractor shall, and shall cause its Subcontractors, to implement commercially reasonable measures no less rigorous than those prescribe by the Center for Internet Security Critical Security Controls framework, and which additionally meet all applicable legal and regulatory compliance standards and controls set forth for the respective data or records in scope of this agreement, including, including audit trails, to protect Mines Data and to ensure the integrity and availability of Mines Data against deterioration or degradation of data quality and authenticity. Contractor will be responsible during the term of the Contract for converting and migrating electronic data as often as necessary so that information is not lost due to hardware, software, or media obsolescence or deterioration.

4.3. Confidentiality. Contractor and Contractor's employees shall keep confidential at all times all Mines Confidential Information and shall comply with all laws and regulations concerning confidentiality of information. Any request or demand by a third party for Mines Confidential

Information in the possession of Contractor shall be immediately forwarded to Mines' Office of General Counsel.

4.4. Specific Requirements for Research Records. If Contractor stores, transmits, or processes Research Records as part of the Mines Data, the following additional requirements shall apply:

a) Contractor shall ensure that Research Records will be stored in accordance with the latest version of NIST Special Publication 800-171;

b) Contractor's workstations and other data processing devices must automatically lock when not in use, and must be manually locked when unattended;

c) Contractor shall not share Research Records on display screens, during demonstrations or presentations, or when sharing screen shots for troubleshooting or other purposes;

d) Contractor shall use encrypt Research Records in transit in accordance with controls set forth in the latest version of NIST Special Publication 800-171. Contractor shall not send any Research Records via email or transport Research Records on removable media;

5. Contractor's Employees; Certification

5.1. Authorized Employee Access. Contractor shall implement strong access controls to ensure that only authorized Contractor employees have access to Mines Data. Contractor employees who are authorized to have access to Mines Data shall be education on the use and confidentiality restrictions set forth in this DPA. Contractor shall promptly disable access privileges to Mines Data for any Contractor employees whose employment is terminated for any reason.

5.2. Employee Background Checks. Contractor shall perform current background checks in a form reasonably acceptable to Mines on all of its respective employees and agents performing services or having access to Mines Data provided under the Contract and/or this DPA, including any Subcontractors or the employees of Subcontractors. A background check performed within 30 days prior to the date such employee or agent begins performance or obtains access to Mines Data shall be deemed to be current. Upon request, Contractor shall provide notice to a designated representative for Mines indicating that background checks have been performed. Such notice will inform Mines of any action taken in response to such background checks, including any decisions not to take action in response to negative information revealed by a background check.

5.3. Certification. Contractor shall comply with the requirements of C.R.S. §§ 24-74-101 through 24- 74-108, and if Contractor is given direct access to any Mines databases containing PII, Contractor shall execute, on behalf of itself and its employees, the certification attached hereto as Exhibit A on an annual basis. Contractor's duty and obligation to certify as set forth in Exhibit A. shall continue for so long as Contractor has direct access to any Mines databases containing PII. If Contractor uses any Subcontractors to perform services requiring direct access to Mines databases containing PII, the Contractor shall require such Subcontractors to execute and deliver the certification to Mines on an annual basis, so long as the Subcontractor has access to Mines databases containing PII.

6. Security Incident and Security Breach

6.1. Security Incident Evaluation. In the event of an Incident, Contractor shall follow industry best practices to fully investigate and resolve the Incident, and take steps to prevent developments that may result in the Incident becoming a Security Breach at Contractor's expense in accordance with applicable privacy laws.

6.2. Response and Notice to Mines. Upon becoming aware of a Security Breach, or of circumstances that are reasonably understood to suggest an actual or suspected Security Breach involving Mines Data, Contractor shall immediately notify Mines in writing, consistent with applicable state or federal laws, fully investigate the Security Breach, cooperate fully with Mines' investigation of and response to the incident, and use best efforts to prevent any further Security Breach at Contractor's expense in accordance with applicable privacy laws. Except as otherwise required by law, Contractor shall not provide notice of an actual or suspected Security Breach directly to (a) individuals whose Personally Identifiable Information was involve, (b) regulatory agencies, or (c) other entities, without the prior written permission of Mines.

6.3. Security Breach Report. If Mines reasonably determines that Contractor has committed a Security Breach, then Mines may request Contractor to submit, within seven (7) calendar days from discovery of such breach, a written report, and any supporting documentation, identifying

(i) the nature of the Security Breach, (ii) the steps Contractor has executed to investigate the Security Breach, (iii) what Mines Data or PII was involved or disclosed, (iv) who or what was the cause of the Security Breach, (v) what Contractor has done or shall do to remediate any deleterious effect of the Security Breach, and (vi) what corrective action Contractor has taken or shall take to prevent a future Incident or Security Breach. To the extent time and circumstances allow, Contractor shall provide Mines with an opportunity to consult with Contractor regarding its remediation plans, and will consider Mines' requests in good faith, consistent with Contractor's requirements for an expedient and uniform response across Contractor's customer base.

6.4. Liability for Security Breach. Contractor shall be responsible for all costs, including but not limited to engagement of forensic investigators, related to the unauthorized access, use, or disclosure of Mines Data. In addition to any other remedies available to Mines under law or equity, the Contractor shall reimburse Mines in full for all costs not covered by Contractor's insurance incurred by Mines in the investigation and remediation of any Security Breach to the extent caused, in whole or in part, by Contractor or Contractor's Subcontractors, including but not limited to: (i) providing notification to individuals whose Personally Identifiable Information was compromised and to regulatory agencies or other entities as required by law or contract; (ii) providing one year's credit monitoring to the affected individuals if the Personally Identifiable Information exposed during the breach could be used to commit financial identify theft; and (iii) the payment of legal fees, audit costs, fines, and other fees imposed by regulatory agencies or contracting partners against Mines as a result of the Security Breach.

7. Response to Legal Orders, Demands, or Requests for Data

7.1. Received by Mines. If Mines receives a subpoena, warrant, or other legal order, demand, or request seeking Mines Data maintained by Contractor, Mines will promptly provide a copy to Contractor. Within two (2) business days, Contractor will supply Mines with copies of data required for Mines to respond and will cooperate with Mines’ reasonable requests in connection with its response.

7.2. Received by Contractor. Except as otherwise expressly prohibited by law, Contractor shall:

a. Immediately notify Mines of any subpoenas, warrants, or other legal orders, demands, or requests received by Contractor seeking University data;

b. Consult with Mines regarding Contractor’s response;

c. Cooperate with Mines’ reasonable requests in connection with efforts by Mines to intervene and quash or modify the legal order, demand, or request; and

d. Upon Mines’ request, provide Mines with a copy of its response.

7.3. Request by Individual. Contractor shall use reasonable and good faith efforts to assist Mines in fulfilling requests from individuals to review or correct their PII stored or processed on Contractor's systems.

7.4. Access to Mines Data. At all times during the term of this DPA, Mines retains the right to access and retrieve any or all Mines Data stored by or in possession of Contractor upon written notice to Contractor. If another timeline for response is provided herein, then that more specific deadline shall control. Otherwise, Contractor shall make Mines Data available to Mines within five (5) business days from the date of request.

8. Term; Termination

8.1. Term. This DPA becomes effective upon mutual execution by the Parties and shall automatically terminate without any further action of the Parties upon the termination or expiration of the Contract or the successful completion of the Services, unless earlier terminated as set forth herein.

8.2. Breach as Grounds for Termination. Mines may immediately terminate the Contract if, at any time, Mines determines in its sole discretion, that Contractor has breached any of the requirements of this DPA. Further, any Security Breach that results in the unauthorized access, use or disclosure of Mines Data is a material breach of this DPA and University may immediately terminate this DPA and the Contract by giving written notice to Contractor. If Mines terminates this Agreement due to a breach of the requirements of this DPA, including a Security Breach by Contractor, Mines shall be entitled to a refund of any monies paid in advance under the Contract, prorated to the effective date of termination. Contractor acknowledges that, as a result of a Security Breach, Mines may elect to disqualify Contractor and its Subcontractors from future contracts with Mines.

8.3. Additional Grounds for Termination. Mines may terminate the Contract if it receives information that Contractor has failed to comply with the same or substantially similar security obligations set forth herein with another institute of higher education.

9. Data Transfer or Destruction Upon Termination or Expiration

9.1. Contingency Plan for Business Cessation. Contractor shall notify Mines of impending cessation of its business or that of a Subcontractor holding or maintaining Mines Data as authorized under this DPA and any contingency plans. Contractor shall implement its exit plan and take all necessary actions to ensure a smooth transition of service with minimal disruption to Mines.

Contractor will work closely with its successor to ensure a successful transition of Mines Data, with minimal downtime and effect on Mines.

9.2. Data Availability After Termination or Expiration. Upon termination or expiration of the

Contract or this DPA, Contractor shall ensure that all Mines Data and Personally Identifiable Information that Contractor collected, generated, or inferred pursuant to the Contract ("Contract Data") is securely returned or securely destroyed, as directed by Mines in its sole discretion. If Mines requests destruction of Mines Data and Contract Data, Contractor shall securely destroy all Contract Data that is in its possession and cause its Subcontractors to securely destroy all Contract Data that is in the possession of any Subcontractors. If Mines requests return of the Contract Data or transfer to a third-party designated by Mines, Contractor shall securely return or transfer all Mines Data and Contract Data to the authorized person specified by Mines, using the methods required by Mines in its sole discretion. Such return or transfer of Mines Data shall occur within a reasonable period of time, and without significant interruption in service.

9.3. Download File. Upon request by Mines made any time prior to sixty (60) days following the termination of the Contract or this DPA for any reason, Contractor shall, and shall cause its Subcontractors to, make available to Mines a complete download file of all Mines Data. This download file shall be made available to Mines within ten (10) business days of Mines' request, shall be encrypted and appropriately authenticated, and shall contain, without limitation, all Mines Data, including metadata.

9.4. Certification of Return or Destruction. Upon destruction or return of Mines Data and Contract

Data, the Contractor shall promptly certify in writing to Mines that Mines Data and Contract Data has been securely disposed of or returned to Mines. This provision will also apply to all Mines Data that is in the possession of Subcontractors.

10. Audits

10.1. Mines Right to Audit. Mines reserves the right in its sole discretion to perform audits of Contractor at Mines' expense to ensure compliance with the terms of this DPA. Contractor shall reasonably cooperate in the performance of such audits and shall provide Mines with information reasonably required to assess Contractor's compliance, including the following:

a) An annual SOC2 Type II audit including, at a minimum, the Trust Principles of Security, Confidentiality, and Availability, or an alternative audit recommended by Mines; or

b) The performance of security audit, vulnerability scans, and penetration tests, all conducted by a third-party, as required by Mines. Contractor shall provide Mines with the results of all such activities and tests, and Contractor will use best efforts to remediate any vulnerabilities.

11. Compliance with Applicable Law

11.1. Applicable Laws and Industry Standards. Contractor shall comply with all applicable state, federal, and international laws, as well as industry best practices, governing the collection, access, use, disclosure, safeguarding, and destruction of Mines Data, including, but not limited to the Health Information Portability and Accountability Act (HIPAA), IRS Publication 1075, Payment Card Industry Data Security Standard, Gramm-Leach Bliley Financial Modernization Act of 1999, FBI Criminal Justice Information Service Security Addendum, NIST Special Publication 800-171, DFARS Clause 252.204-7012, CMS Minimum Acceptable Risk Standards for Exchanges, Electronic Information Exchange Security Requirements and Procedures for

State and Local Agencies Exchanging Electronic Information with the Social Security Administration, the Americans with Disabilities Act, Federal Export Administration Regulations, Federal Acquisition Regulations, Defense Federal Acquisition Regulations, and Department of Education guidance.

11.2. Contractor Compliance. Contractor warrants that it shall implement and maintain all appropriate administrative, physical, technical, and procedural safeguards necessary and appropriate to ensure compliance with the standards and guidelines applicable to Contractor’s performance under this DPA and the Contract.

12. Indemnification

12.1. Indemnification. Contractor shall indemnify and hold Mines, the State of Colorado, and their respective board members, officers, directors, employees, and agents (collectively, the “Indemnified Parties”) from and against all losses, damages, liabilities, deficiencies, actions, judgments, interest, award, penalties, fines, costs or expenses, including attorneys’ fees, the costs of enforcing any right to indemnification hereunder and the cost of pursuing any insurance providers, arising out of or resulting from any third-party claim against the Indemnified Parties arising out of or resulting from Contractor’s failure to comply with any of its obligations under this DPA. Contractor’s indemnification obligations under this section shall survive the termination or expiration of this DPA.

13. Insurance

13.1. Network Security & Privacy Liability Coverage. In addition to the coverage types and amounts Contractor is required to maintain pursuant to the terms of the Contract, Contractor shall also procure and maintain at all times during the term of this DPA, Network Security and Privacy Liability insurance, covering civil, regulatory, and statutory damages, contractual damages, data breach management exposure (including but not limited to unauthorized access to, use of or tampering with computer systems, including hacker attacks, introduction of virus, malware, spyware, or ransomware, or inability of an authorized third party to gain access to Contractor's services including denial of service), and any loss of income or extra expense as a result of actual or alleged breach, violation or infringement of right to privacy, consumer data protection law, confidentiality or other legal protection for personal information, as well as Mines Data, with minimum limits as follows: $1,000,000 each occurrence, and $2,000,000 general aggregate.

13.2. Additional Requirements. In addition to the foregoing requirements, the policy shall provide a waiver of subrogation in favor of Mines and shall be endorsed to include "The Board of Trustees of the Colorado School of Mines, for and on behalf of the Colorado School of Mines" as an additional insured with respect to liability arising out of the activities performed by, or on behalf of the Contractor. Contractor shall provide Mines with a certificate of insurance evidencing the requirements set forth in this Section 13 within thirty (30) days of signing this

DPA.

13.3. Exclusion of Insurance Proceeds from Limitation of Liability. Any limitation of liability applicable to Contractor under the Contract is modified to specifically exclude any insurance proceeds payable to either Contractor as named insured or to Mines as an additional insured for claims filed under Contractor's Cyber/Network Security and Privacy Liability insurance coverage.

14. Miscellaneous

14.1. Governmental Immunity. Nothing contained in this DPA shall be construed or interpreted as a waiver, express or implied, of the Colorado Governmental Immunity Act, C.R.S. § 24-10- 101 et seq., or the Federal Torts Claim Act 28 U.S.C. 2671 et seq., as applicable, as now or hereafter amended.

14.2. Survival. Upon expiration or termination of this DPA, the obligations which by their nature are intended to survive expiration or termination of this DPA shall survive.

14.3. Open Records Act. Contractor acknowledges and agrees that this DPA and all documents

Contractor provides Mines as required herein, are public records for purposes of the Colorado Open Records Act, C.R.S. § 24-72-101 et seq., as amended, and shall at all times be subject to public inspection.

IN WITNESS WHEREOF, the Parties have executed this Data Protection Addendum as of the date of the last party to sign.

THE PARTIES HERETO HAVE EXECUTED THIS AGREEMENT

THE BOARD OF TRUSTEES OF THE

COLORADO SCHOOL OF MINES, for and on behalf of the Colorado School of Mines

Company Name

By: $docusign:SignHere::InternalSigner1 By: $docusign:SignHere::Customer1

Name: $docusign:FullName::InternalSigner1 Name: $docusign:FullName::Customer1

Title: $docusign:Title::InternalSigner1 Title: $docusign:Title::Customer1

Date: $docusign:DateSigned::InternalSigner1 Date: $docusign:DateSigned::Customer1

E. Termination for Convenience