Exhibit E - PO Terms and Conditions - Rev. 09.2026.pdf

Page 1 of 20 Rev. 09/2026

Purchase Order Terms and Conditions

Section 1: Offer/Acceptance.

This Purchase Order, together with these terms and conditions (including, if applicable, Addendum 1: Additional Terms and Conditions for Information Technology (“Addendum 1”), and Addendum 2: Additional Terms and Conditions for Federal Provisions (“Addendum 2”), and any other attachments, exhibits, specifications, or appendices, whether attached or incorporated by reference (collectively the “PO”) shall represent the entire and exclusive agreement between the State and the Vendor with respect to the subject matter hereof. If this PO refers to Vendor’s bid or proposal, this PO is an ACCEPTANCE of Vendor’s OFFER TO SELL in accordance with the terms and conditions of this PO. If a bid or proposal is not referenced, this PO is an OFFER TO BUY, subject to Vendor’s acceptance, demonstrated by Vendor’s performance or written acceptance of this PO. Any COUNTER-OFFER TO SELL automatically CANCELS this PO, unless a change order accepting the counter-offer is issued in accordance with §4. The State shall not be responsible or liable for goods or services delivered or performed prior to issuance of this PO.

Section 2: Order of Precedence.

In the event of a conflict or inconsistency within this PO, such conflict or inconsistency shall be resolved by giving preference to the documents in the following order of priority:

• A. If applicable, Addendum 2;

• B. the Purchase Order document;

• C. these Terms and Conditions (including, if applicable, Addendum 1; and

• D. any attachments, exhibits, specifications, or appendices, whether attached or incorporated by reference.

Any terms and conditions included on Vendor's forms or invoices not included in this PO are void.

Section 3: Safety Information.

All chemicals, equipment, and materials proposed or used in the performance of this PO shall conform to the requirements of the Occupational Safety and Health Act of 1970. Vendor shall furnish all Material Safety Data Sheets for any regulated chemicals, equipment, or hazardous materials at the time of delivery.

Section 4: Modifications.

Vendor shall furnish goods and services in strict accordance with the specifications and price set forth in this PO for each item. This PO shall not be modified, superseded or otherwise altered, except in writing signed by the State and accepted by Vendor. If this PO is for goods only and Vendor delivers some or all of the goods to the State after expiration or earlier termination of this PO, then the State, in its sole discretion, may accept such goods by extending this PO, in writing, and delivering the modification to Vendor. If the State does not extend this PO for any reason, then the goods delivered after expiration or earlier termination of this PO shall be deemed rejected, Vendor shall arrange the return of all

Page 2 of 20 Rev. 09/2026 delivered goods at Vendor’s sole expense, and the State shall have no liability for any such goods.

Section 5: Delivery.

Unless otherwise specified in this PO, delivery shall be FOB destination, freight prepaid and allowed. The State is relying on the promised delivery date and any installation or service performance set forth in this PO as material and basic to the State’s acceptance. If Vendor fails to deliver or perform as and when promised, the State, in its sole discretion, may cancel its order, or any part thereof, without prejudice to its other rights, return all or part of any shipment so made, at Vendor’s expense, and charge Vendor with any loss or expense sustained as a result of such failure to deliver or perform as promised. Time is of the essence.

Section 6: Rights to Materials.

[Not Applicable to POs issued either in whole or in part for Information Technology, as defined in § 24-37.5-102(12), C.R.S.; which shall be governed by Addendum 1.] Unless specifically stated otherwise in this PO, all materials, including without limitation supplies, equipment, documents, content, information, or other material of any type, whether tangible or intangible (collectively “Materials”), furnished by the State to Vendor or delivered by Vendor to the State in performance of Vendor’s obligations under this PO shall be the exclusive property of the State. Vendor shall return or deliver all Materials to the State upon completion or termination of this PO.

Section 7: Reporting.

If Vendor is served with a pleading or other document in connection with an action before a court or administrative decision-making body, and such pleading or document relates to this PO or may affect Vendor’s ability to perform its obligations under this PO, Vendor shall, within 10 days after being served, notify the State of such action and deliver copies of such pleading or document to the State. Vendor shall disclose, in a timely manner, in writing to the State all violations of federal or state criminal law involving fraud, bribery, or gratuity violations potentially affecting this PO. The State may impose any remedies available at law, in equity, which may include, without limitation, suspension or debarment.

Section 8: Conflicts of Interest.

Vendor acknowledges that with respect to this PO, even the appearance of a conflict of interest is harmful to the State’s interests. Absent the State’s prior written approval, Vendor shall refrain from any practices, activities, or relationships that reasonably may appear to be in conflict with the full performance of Vendor’s obligations to the State hereunder. If a conflict or appearance of a conflict of interest exists, or if Vendor is uncertain as to such, Vendor shall submit to the State a disclosure statement setting forth the relevant details for the State’s consideration. Failure to promptly submit a disclosure statement or to follow the State’s direction with respect to the actual or apparent conflict constitutes a breach of this PO. Vendor acknowledges that all State employees are subject to the ethical principles described in § 24-18-105, C.R.S. Vendor further acknowledges that State employees may be subject to the requirements of § 24-18-105, C.R.S. with regard to this PO.

Section 9: Warranties.

Page 3 of 20 Rev. 09/2026

All provisions and remedies of the Colorado Uniform Commercial Code, Title 4, C.R.S.

(“UCC”), relating to implied or express warranties for goods are incorporated herein, in addition to any warranties contained in this PO.

Section 10: Inspection and Acceptance.

The State’s final acceptance of goods or services is contingent upon completion of all applicable inspection procedures. All goods delivered shall be newly manufactured and the current model, unless otherwise specified. The State shall have the right to inspect goods or services provided under this PO at all reasonable times and places. The State shall be the sole judge in determining “equals” with regard to conformance with the specifications outlined in this PO for quality, price, and performance. If any of the goods or services do not conform to this PO, the State, at its sole discretion, may require Vendor to either:

• A. replace the goods specified by the State; or

• B. perform the services again, without additional payment from the State.

When defects in the quality or quantity of goods or services cannot be corrected by replacement or re-performance, the State may:

• A. require Vendor to take necessary action to ensure that future performance conforms to this PO; and

• B. equitably reduce the payment due Vendor to reflect the reduced value of the goods or services performed.

These remedies do not limit the remedies otherwise available in this PO, at law, or in equity.

Section 11: Taxes.

The State is exempt from federal excise taxes and from State and local sales and use taxes.

Vendor shall be solely responsible.

Section 12: Payment.

The State shall not pay Vendor any amount for performance under this PO in excess of the PO purchase price set forth on the Cover Page of the Purchase Order document. The State shall pay Vendor for all amounts due within 45 days after the State’s receipt of goods or services and acceptance of a correct invoice of amount due. Amounts not paid by the State within 45 days of the State’s acceptance of the invoice shall bear interest on the unpaid balance beginning on the 45th day at the rate set forth in § 24-30-202(24), C.R.S. until paid in full.

Interest shall not accrue if a good faith dispute exists as to the State’s obligation to pay all or a portion of the amount due. Vendor shall invoice the State separately for interest on delinquent amounts due, referencing the delinquent payment, number of days interest to be paid, and applicable interest rate. The State may benefit from any early payment discount offered by Vendor by making payment within the timeframes required by Vendor to be eligible for such discount. If Vendor offers an early payment discount, then the discount shall be shown on Vendor’s invoices to the State, and if the State makes payment on the invoice within the time frame for the discount, Vendor shall either:

• A. accept the payment amount less the appropriate discount; or

Page 4 of 20 Rev. 09/2026

• B. refund the discount back to the State.

Except as specifically agreed in this PO, Vendor shall be solely responsible for all costs, expenses, and other charges it incurs in connection with its performance under this PO.

Section 13: Assignment.

Vendor’s rights and obligations under this PO shall not be transferred or assigned without the prior, written consent of the State and execution of a new PO. Any attempt at assignment or transfer without such consent and new PO shall be void. Any new PO approved by the State shall be subject to the same terms and conditions as those set forth in this PO.

Section 14: Subcontracts.

Unless otherwise specified in this PO, Vendor shall not enter into any subcontract in connection with its obligations under this PO without the prior, written approval of the State.

Vendor shall submit to the State a copy of each such subcontract upon request by the State.

All subcontracts entered into by Vendor in connection with this PO shall comply with all applicable federal and state laws and regulations and shall be subject to all provisions of this

PO.

Section 15: Severability.

The invalidity or unenforceability of any provision of this PO shall not affect the validity or enforceability of any other provision of this PO, which shall remain in full force and effect, provided that the parties to this PO (individually, a “Party” and collectively, “Parties”) can continue to perform their obligations in accordance with the intent of this PO.

Section 16: Survival of Certain PO Terms.

Any provision of this PO that imposes an obligation on a Party after termination or expiration of this PO shall survive the termination or expiration of this PO and shall be enforceable by the other Party.

Section 17: Third Party Beneficiaries.

Except for the Parties’ respective successors and assigns, this PO does not and is not intended to confer any rights or remedies upon any person or entity other than the Parties.

Enforcement of this PO and all rights and obligations hereunder is reserved solely to the Parties. Any services or benefits which third parties receive as a result of this PO are incidental to this PO, and do not create any rights for such third parties.

Section 18: Waiver.

A Party’s failure or delay in exercising any right, power, or privilege under this PO, whether explicit or by lack of enforcement, shall not operate as a waiver, nor shall any single or partial exercise of any right, power, or privilege preclude any other or further exercise of such right, power, or privilege.

Section 19: Indemnification. [Not Applicable to Inter-governmental POs]

Vendor shall indemnify, save, and hold harmless the State, its employees, agents, Subcontractors, and assignees (the “Indemnified Parties”), against any and all costs, Page 5 of 20 Rev. 09/2026 expenses, claims, damages, liabilities, court awards and other amounts (including attorneys’ fees and related costs) incurred by any of the Indemnified Parties in relation to any act or omission by Vendor, or its employees, agents, or, subcontractors in connection with this PO.

This shall include, without limitation, any and all costs, expenses, claims, damages, liabilities, court awards and other amounts incurred by any of the Indemnified Parties in relation to (i) any claim that any work infringes a patent, copyright, trademark, trade secret, or any other intellectual property right, (ii) any claim for loss or improper disclosure of any confidential information or personally identifiable information and (iii) Vendor’s noncompliance with §§ 24-85-101, C.R.S., or the Accessibility Standards for Individuals with a Disability as established by the Office of Information Technology pursuant to § 24-85-103, C.R.S. State employees are considered third parties for the purposes of this § 19.iii.

Section 20: Notice.

All notices given under this PO shall be in writing, and shall be delivered to the contacts for each Party listed on the Cover Page of this Purchase Order document. Either party may change its contact or contact information by notice submitted in writing to the other party without a formal modification to this PO.

Section 21: Insurance.

Except as otherwise specifically stated in this PO, Vendor shall obtain and maintain insurance as specified in this section at all times during the term of this PO. All insurance policies required by the PO shall be issued by insurance companies rated AM Best A-VIII or higher:

• A. Workers’ compensation insurance as required by state statute, and employers’ liability insurance covering all Vendor employees acting within the course and scope of their employment;

• B. Commercial general liability insurance written on an Insurance Services Office occurrence form, covering premises operations, fire damage, independent contractors, products and completed operations, blanket contractual liability, personal injury, and advertising liability with minimum limits as follows: $1,000,000 each occurrence; $1,000,000 general aggregate; $1,000,000 products and completed operations aggregate; and $50,000 any one fire; and

• C. Automobile liability insurance covering any auto (including owned, as applicable, hired and non-owned autos) with a minimum limit of $1,000,000 each accident combined single limit.

• D. If Vendor will or may have access to any protected information, then Vendor shall also obtain and maintain insurance covering loss and disclosure of protected information and claims based on alleged violations of privacy right through improper use and disclosure of protected information with limits of $1,000,000 each occurrence and $1,000,000 general aggregate at all times during the term of this PO. This can be combined and/or included in a cyber insurance policy.

• E. Additional insurance may be required as provided elsewhere in this PO. All insurance policies required by this PO shall be issued by insurance companies with an AM Best rating of A-VIII or better. This insurance requirement shall not apply if this PO is solely for goods, as determined by the State, unless specifically stated otherwise in

Page 6 of 20 Rev. 09/2026 this PO or any attachment or exhibit to this PO. If Vendor is a public agency within the meaning of the Colorado Governmental Immunity Act, then this Section shall not apply and Vendor shall instead comply with the Colorado Governmental Immunity Act. The State shall be named as additional insured on all commercial general liability policies required of Vendor. All insurance policies secured or maintained by Vendor in relation to this Purchase Order shall include clauses stating that each carrier shall waive all rights of recovery under subrogation or otherwise against Vendor or the State, its agencies, institutions, organizations, officers, agents, employees, and volunteers.

Section 22: Termination Prior to Vendor Acceptance.

If Vendor has not begun performance under this PO, the State may cancel this PO by providing written notice to the Vendor.

Section 23: Termination for Cause.

• A. If Vendor refuses or fails to timely and properly perform any of its obligations under this PO with such diligence as will ensure its completion within the time specified in this PO, the State may notify Vendor in writing of non-performance and, if not corrected by Vendor within the time specified in the notice, terminate Vendor’s right to proceed with this PO or such part thereof as to which there has been delay or a failure. Vendor shall continue performance of this PO to the extent not terminated.

• B. Vendor shall be liable for excess costs incurred by the State in procuring similar goods or services and the State may withhold such amounts as the State deems necessary.

• C. If after rejection, revocation, or other termination of Vendor’s right to proceed under the UCC or this clause, the State determines for any reason that Vendor was not in default or the delay was excusable, the rights and obligations of the State and Vendor shall be the same as if the notice of termination had been issued pursuant to termination under §24.

Section 24: Termination in Public Interest.

The State is entering into this PO to serve the public interest of the State of Colorado, as determined by its Governor, General Assembly, or Courts. If this PO ceases to further the public interest of the State, the State, in its sole discretion, may terminate this PO in whole or in part and such termination shall not be deemed to be a breach of the State’s obligations hereunder. This Section shall not apply to a termination for cause, which shall be governed by §23. A determination that this PO should be terminated in the public interest shall not be equivalent to a State right to terminate for convenience. If the State terminates this PO in the public interest, the State shall pay Vendor an amount equal to the percentage of the total reimbursement payable under this PO that corresponds to the percentage of goods or services satisfactorily delivered, completed, and accepted, as determined by the State, less payments previously made. Additionally, if this PO is less than 60% completed, as determined by the State, the State may reimburse Vendor for a portion of actual out-of-pocket expenses, not otherwise reimbursed under this PO, incurred by Vendor which are directly attributable to the uncompleted portion of the Vendor’s obligations, provided that the sum of any and all reimbursement shall not exceed the total PO price.

Page 7 of 20 Rev. 09/2026

Section 25: Available Funds-Contingency-Termination.

The State is prohibited by law from making commitments beyond the current State Fiscal Year. State Fiscal Year means a 12 month period beginning on July 1 of each calendar year and ending on June 30 of the following calendar year. Payment to Vendor beyond the current State Fiscal Year is contingent on the appropriation and continuing availability of PO funds in any subsequent year. If federal funds or funds from any other non-State funds constitute all or some of the PO funds the State’s obligation to pay Vendor shall be contingent upon such non- State funding continuing to be made available for payment. Payments to be made pursuant to this PO shall be made only from funds appropriated and made available for this PO, and the State’s liability for such payments shall be limited to the amount remaining of such PO funds.

If State, federal or other funds are not appropriated, or otherwise become unavailable to fund this Contract, the State may, upon written notice, terminate this PO, in whole or in part, without incurring further liability. The State shall, however, remain obligated to pay for Services and Goods that are delivered and accepted prior to the effective date of notice of termination, and this termination shall otherwise be treated as if this PO were terminated in the public interest as described in §24.

Section 26: Governmental Immunity.

Liability for claims for injuries to persons or property arising from the negligence of the State, its departments, boards, commissions committees, bureaus, offices, employees and officials shall be controlled and limited by the provisions of the Colorado Governmental Immunity Act, §§ 24-10-101, C.R.S., the Federal Tort Claims Act, 28 U.S.C. Pt. VI, Ch. 171 and 28 U.S.C.

1346(b), and the State’s risk management statutes, §§ 24-30-1501, C.R.S. No term or condition of this PO shall be construed or interpreted as a waiver, express or implied, of any of the immunities, rights, benefits, protections, or other provisions contained in these statutes.

Section 27: Independent Contractor.

Vendor shall perform its duties under this PO as an independent contractor and not as an employee. Neither Vendor nor any agent or employee of Vendor shall be deemed to be an agent or employee of the State. Vendor shall not have authorization, express or implied, to bind the State to any agreement, liability or understanding, except as expressly set forth herein. Vendor and its employees and agents are not entitled to unemployment insurance or workers compensation benefits through the State and the State shall not pay for or otherwise provide such coverage for Vendor or any of its agents or employees. Vendor shall pay when due all applicable employment taxes, income taxes and local head taxes incurred pursuant to this PO. Vendor shall:

• A. provide and keep in force workers' compensation and unemployment compensation insurance in the amounts required by law,

• B. provide proof thereof when requested by the State, and

• C. be solely responsible for its acts and those of its employees and agents.

Section 28: Compliance with Law.

Page 8 of 20 Rev. 09/2026

Vendor shall comply with all applicable federal and state laws, rules, and regulations in effect or hereafter established, including, without limitation, laws applicable to discrimination and unfair employment practices.

Section 29: Choice of Law, Jurisdiction and Venue. [Not Applicable to Inter-governmental POs]

Colorado law, and rules and regulations issued pursuant thereto, shall be applied in the interpretation, execution, and enforcement of this PO. The UCC shall govern this PO in the case of goods unless otherwise agreed in this PO. Any provision included or incorporated herein by reference, which conflicts with said laws, rules, and regulations shall be null and void. All suits or actions related to this PO shall be filed and proceedings held in the State of Colorado and exclusive venue shall be in the City and County of Denver. Any provision incorporated herein by reference which purports to negate this or any other provision in this PO in whole or in part shall not be valid or enforceable or available in any action at law, whether by way of complaint, defense, or otherwise. Vendor shall exhaust administrative remedies in § 24-109-106, C.R.S., prior to commencing any judicial action against the State.

Section 30: Prohibited Terms.

Nothing in this PO shall be construed as a waiver of any provision of § 24-106-109, C.R.S. Any term included in this PO that requires the State to indemnify or hold Vendor harmless;

requires the State to agree to binding arbitration; limits Vendor’s liability for damages resulting from death, bodily injury, or damage to tangible property; or that conflicts with that statute in any way shall be void ab initio.

Section 31: Vendor Offset and Erroneous Payments. [Not Applicable to Inter-governmental POs]

The State Controller may withhold payment under the State’s Vendor offset intercept system for debts owed to State agencies for:

• A. unpaid child support debts or child support arrearages;

• B. unpaid balances of tax, accrued interest, or other charges specified in § 39-21- 101, C.R.S.;

• C. unpaid loans due to the Student Loan Division of the Department of Higher Education;

• D. amounts required to be paid to the Unemployment Compensation Fund; and

• E. other unpaid debts owing to the State as a result of final agency determination or judicial action.

The State may also recover, at the State's discretion, payments made to Vendor in error for any reason, including, but not limited to, overpayments or improper payments, and unexpected or excess funds received by Vendor by deduction from subsequent payments under this PO, deduction from any payment due under any other contracts, grants or agreements between the State and Vendor, or by any other appropriate method for collecting debts owed to the State.

Page 9 of 20 Rev. 09/2026

Section 32: Accessibility.

Vendor shall comply with the Accessibility Standards for Individuals with a Disability, as adopted by the Office of Information Technology pursuant to § 24-85-103, C.R.S.

The State may require that Vendor’s compliance with the Accessibility Standards for Individuals with a Disability adopted by the Office of Information Technology pursuant to §24- 85-103, C.R.S., be determined and tested by a qualified third party selected by the State.

The State may ask the Vendor to review the selection of the third party. Vendor shall be responsible for all costs associated with the third party vendor’s assessment. If Vendor is not in compliance as determined by the third party vendor, at the State’s request and at the State’s direction, Vendor shall promptly take all necessary actions to come into compliance using a State-approved vendor, at no additional cost to the State.

Page 10 of 20 Rev. 09/2026

ADDENDUM 1: Additional Terms & Conditions for Information Technology

IF ANY PART OF THE SUBJECT MATTER OF THIS PO IS INFORMATION TECHNOLOGY, AS DEFINED IN § 24-37.5-102 (12), C.R.S., THE FOLLOWING PROVISIONS ALSO APPLY TO THIS PO. Language, if any, in the main body of this Purchase Order, any other Addendum, or any attachments, exhibits, specifications, or appendices, whether attached or incorporated by reference, referencing “Force Majeure,” or anything substantially similar to Force Majeure, shall not apply to this Addendum 1. The provisions of this Addendum 1 are of vital importance to the State and the security of the State.

Section 1: Definitions.

The following terms shall be construed and interpreted as follows:

• A. “Business Day” means any day in which the State is open and conducting business, but shall not include Saturday, Sunday or any day on which the State observes one of the holidays listed in § 24-11-101(1), C.R.S.;

• B. “CJI” means criminal justice information collected by criminal justice agencies needed for the performance of their authorized functions, including, without limitation, all information defined as criminal justice information by the U.S.

Department of Justice, Federal Bureau of Investigation, Criminal Justice Information Services Security Policy, as amended, and all Criminal Justice Records as defined under § 24-72-302, C.R.S.;

• C. “HIPAA” means the federal Health Information Portability and Accountability Act

• D. “Incident” means any accidental or deliberate event that results in or constitutes an imminent threat of the unauthorized access, loss, disclosure, modification, disruption, or destruction of any communications or information resources of the State, pursuant to §§ 24-37.5-401, C.R.S.;

• E. “PCI” means payment card information including any data related to credit card holders’ names, credit card numbers, or the other credit card information as may be protected by state or federal law;

• F. “PHI” means any protected health information, including, without limitation any information whether oral or recorded in any form or medium that relates to the past, present or future physical or mental condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and that identifies the individual or with respect to which there is a reasonable basis to believe the information can be used to identify the individual including, without limitation, any information defined as Individually Identifiable Health Information by HIPAA;

• G. “PII” means personally identifiable information including, without limitation, any information maintained by the State about an individual that can be used to distinguish or trace an individual’s identity, such as name, social security number, date

Page 11 of 20 Rev. 09/2026 and place of birth, mother’s maiden name, or biometric records, including, without limitation, all information defined as personally identifiable information in § 24-72- 501, C.R.S. “PII” shall also mean “personal identifying information” as set forth at §§ 24-74-102, C.R.S.;

• H. “State Confidential Information” means any and all State Records not subject to disclosure under the Colorado Open Records Act, §§ 24-72-200.1, C.R.S. (“CORA”), and includes, without limitation, PII, PHI, PCI, Tax Information, CJI, and State personnel records not subject to disclosure under CORA;

• I. “State Records” means any and all State data, information, and records, regardless of physical form;

• J. “Tax Information” means federal and State of Colorado tax information including, without limitation, federal and State tax returns, return information, and such other tax-related information as may be protected by federal and State law and regulation, including, without limitation all information defined as federal tax information in Internal Revenue Service Publication 1075; and

• K. “Work Product” means the tangible and intangible results of the delivery of goods and performance of services, whether finished or unfinished, including drafts.

Section 2: Information Technology and Data Handling of State Records.

To the extent Vendor provides physical or logical storage of, or is given access to, State records to perform its obligations under this PO, Vendor shall strictly adhere to the following data protection and handling requirements:

• 2.1 Security Baseline (NIST): Vendor shall implement and maintain physical, administrative, and technical security controls that meet or exceed the current version of the NIST SP 800-53 framework, as well as all applicable industry standards (e.g., HIPAA, PCI-DSS, CDIS) relevant to the data classification.

• 2.2 OIS Security Audits & Policy Compliance: vendor shall comply with all Colorado Office of Information Security (OIS) rules, policies, and guidelines promulgated pursuant to §§ 24-37.5-401 through 406, C.R.S., and 8 CCR § 1501-5. Vendor shall review these policies semi-annually and cooperate fully with any security audits or penetration tests conducted by OIS or its designee.

• 2.3 Data Location and Remote Access: Vendor shall hold and maintain all State Confidential Information in secure facilities located exclusively within the United States. Vendor shall not allow remote access to State Records from outside the United States, including by its employees or agents, without the prior express written consent of OIS

• 2.4 Data Extraction & Transition: Upon request by the State (made at any time prior to 60 days following PO termination), Vendor shall provide a complete, encrypted, and appropriately authenticated download file of all State Records, Work Product, and system schema. This file must be provided within 10 Business Days of the request. The State retains the right to access and retrieve State Records stored on Vendor’s infrastructure at its sole discretion at any time.

Page 12 of 20 Rev. 09/2026

• 2.5 Data Return and Destruction: Upon termination of services, and at no cost to the State, Vendor shall return or securely destroy all State Records and copies thereof, certifying to the State that it has done so. If legal obligations prevent return or destruction, Vendor warrants it will guarantee the confidentiality of the records and actively cease processing them.

Section 3: Information, Privacy, and Incident Response.

• 3.1 Information Confidentiality. Vendor shall keep confidential, and cause all subcontractors to keep confidential, all State Records, unless those State Records are publicly available. Vendor shall not, without prior written approval of the State, use, publish, copy, disclose to any third party, or permit the use by any third party of any State Records, except as otherwise stated in this PO, permitted by law, or approved in writing by the State. Vendor shall provide for the security of all State Confidential Information in accordance with all applicable laws, rules, policies, publications, and guidelines. If Vendor or any of its subcontractors will or may have access to any State Confidential Information or any other protected information, Vendor shall comply with all Colorado Office of Information Security (OIS) policies and procedures which OIS has issued pursuant to §§ 24-37.5-401, C.R.S., through 406, and 8 CCR §1501-5 and posted at https://oit.colorado.gov/standards-policies-guides/technical-standards-…, all information security and privacy obligations imposed by any federal, state, or local statute or regulation, or by any industry standards or guidelines, as applicable based on the classification of the data relevant to Vendor’s performance under this PO. Such obligations may arise from HIPAA; IRS Publication 1075; Payment Card Industry Data Security Standard (PCI-DSS); Federal Bureau of Investigation Criminal Justice Information Service Security Addendum; Centers for Medicare & Medicaid Services (CMS) Minimum Acceptable Risk Standards for Exchanges; and Electronic Information Exchange Security Requirements and Procedures for State and Local Agencies Exchanging Electronic Information with the Social Security Administration. Vendor shall immediately forward any request or demand for State Records to the State’s purchasing agent.

• 3.2 Safeguarding PII. If Vendor or any of its subcontractors will or may receive PII under this PO, Vendor shall provide for the security of such PII, in a manner and form acceptable to the State, including, without limitation, all State requirements relating to non-disclosure, use of appropriate technology, security practices, computer access security, data access security, data storage encryption, data transmission encryption, security inspections, and audits. Vendor shall be a “Third Party Service Provider” as defined in § 24-73-103(1)(i), C.R.S. and shall maintain security procedures and practices consistent with §§ 24-73-101, C.R.S. In addition, as set forth in §§ 24-74-102, C.R.S., Contractor, including, but not limited to, Contractor’s employees, agents and Subcontractors, agree not to share any PII with any third parties for the purpose of investigating for, participating in, cooperating with, or assisting with Federal immigration enforcement. If Contractor is given direct access to any State databases containing PII, Contractor shall execute, on behalf of itself and its employees, the certification PII Individual Certification Form or PII Entity Certification Form on an annual basis and Contractor’s duty and obligation to certify shall continue as long as Contractor has direct access to any State databases containing PII. If Contractor uses https://oit.colorado.gov/standards-policies-guides/technical-standards-policies

Page 13 of 20 Rev. 09/2026 any Subcontractors to perform services requiring direct access to State databases containing PII, the Contractor shall require such Subcontractors to execute and deliver the certification to the State on an annual basis, so long as the Subcontractor has access to State databases containing PII.

• 3.3 Subcontractor Access and NDAs. Vendor may provide State Records to its agents, employees, assigns and subcontractors as necessary to perform the work, but shall restrict access to State Confidential Information to those agents, employees, assigns, and subcontractors who require access to perform their obligations under this PO.

Vendor shall ensure all such agents, employees, assigns, and subcontractors sign agreements containing nondisclosure provisions at least as protective as those in this PO, and that the nondisclosure provisions are in force at all times the agent, employee, assign or subcontractor has access to any State Confidential Information.

Vendor shall provide copies of those signed nondisclosure provisions to the State upon execution of the nondisclosure provisions if requested by the State.

• 3.4 Incident Notice and Remediation. If Vendor becomes aware of any Incident, it shall notify the State immediately and cooperate with the State regarding recovery, remediation, and the necessity to involve law enforcement, as determined by the State. Unless Vendor can establish none of Vendor or any of its agents, employees, assigns, or subcontractors are the cause or source of the Incident, Vendor shall be responsible for the cost of notifying each person who may have been impacted by the Incident. After an Incident, Vendor shall take steps to reduce the risk of incurring a similar type of Incident in the future as directed by the State, which may include, but is not limited to, developing and implementing a remediation plan that is approved by the State at no additional cost to the State. The State may adjust or direct modifications to this plan, in its sole discretion, and Vendor shall make all modifications as directed by the State. If Vendor cannot produce its analysis and plan within the allotted time, the State, in its sole discretion, may perform such analysis and produce a remediation plan, and Vendor shall reimburse the State for the reasonable actual costs thereof.

Section 4: Intellectual Property and Software Licensing.

• 4.1 Intellectual Property. Except to the extent specifically provided elsewhere in this PO, any State information, including without limitation pre-existing State software, research, reports, studies, data, photographs, negatives or other documents, drawings, models, materials; or Work Product prepared by Vendor in the performance of its obligations under this PO shall be the exclusive property of the State (collectively, “State IP Materials”). Vendor shall deliver all State IP Materials to the State upon completion or termination of this PO. The State’s exclusive rights in any Work Product prepared by Vendor shall include, but not be limited to, the right to copy, publish, display, transfer, and prepare derivative works. Vendor shall not use, willingly allow, cause or permit any State IP Materials to be used for any purpose other than the performance of Vendor’s obligations hereunder without the prior written consent of the State. The State shall maintain complete and accurate records relating to:

STATE PROPERTY

Page 14 of 20 Rev. 09/2026 o its use of all Vendor and third party software licenses and rights to use any Vendor or third party software granted under this PO and its attachments to which the State is a party and o all amounts payable to Vendor pursuant to this PO and its attachments and the State’s obligations under this PO or to any amounts payable to Vendor in relation to this PO, which records shall contain sufficient information to permit Vendor to confirm the State’s compliance with the use restrictions and payment obligations under this PO or to any third-party use restrictions to which the State is a party.

Vendor retains the exclusive rights, title and ownership to any and all pre-existing materials owned by or licensed to Vendor including, but not limited to all pre-existing software, licensed products, associated source code, machine code, text images, audio, video, and third-party materials, delivered by Vendor under this PO, whether incorporated in a deliverable or necessary to use a deliverable (collectively, “Vendor Property”). Vendor Property shall be licensed to the State as set forth in a State-approved license agreement:

o entered into as exhibits or attachments to this PO, o obtained by the State from the applicable third party Vendor, or o in the case of open source software, the license terms set forth in the applicable open source license agreement.

Notwithstanding anything to the contrary herein, the State shall not be subject to any provision incorporated in any exhibit or attachment attached hereto, any provision incorporated in any terms and conditions appearing on any website, any provision incorporated into any click through or online agreements, or any provision incorporated into any other document or agreement between the Parties that:

o requires the State to indemnify Vendor or any other party, o is in violation of State laws, regulations, rules, fiscal rules, policies, or other State requirements as deemed solely by the State, or is contrary to this PO.

• 4.2 Vendor’s Licensing and Audit Rights. If this PO includes any license or other right to use Vendor’s intellectual property, Vendor shall have the right, at any time during and throughout the term of this PO, but not more than once during any State fiscal year, to request via written notice in accordance with the notice provisions of this PO that the State audit its use of Vendor’s intellectual property and certify as to its compliance with any applicable license or use restrictions and limitations contained in this PO (an “Audit Request”). The Audit Request shall specify the time period to be covered by the audit, which shall not include any time periods covered by a previous audit. The State shall complete the audit and provide certification of its compliance to Vendor (“Audit Certification”) within 120 days following the State’s receipt of the Audit Request. If upon receipt of the State’s Audit Certification, the Parties reasonably determine that:

o the State’s use of licenses, use of software, use of programs, or any other use of intellectual property during the audit period exceeded the use restrictions and limitations contained in this PO (“Overuse”) and

Page 15 of 20 Rev. 09/2026 o the State would have been or is then required to purchase additional rights to use Vendor’s intellectual property (“Additional Rights”), Vendor shall provide written notice to the State in accordance with the notice provisions of this PO identifying any Overuse or required Additional Rights and request that the State bring its use into compliance with such use restrictions and limitations.

Notwithstanding anything to the contrary in this PO, or incorporated as a part of Vendor’s or any subcontractor’s website, click-through or online agreements, third-party agreements, or any other documents or agreements between the Parties, the State shall not be liable for the costs associated with any Overuse or Additional Rights, during the audit period regardless of whether the State may have been notified in advance of such costs.

• 4.3 Software Piracy Prohibition. Vendor warrants that no State or public funds payable under this PO shall be used to acquire, operate, or maintain computer software in violation of federal copyright laws or applicable licensing restrictions. Vendor shall maintain appropriate systems and controls to prevent such improper use of public funds. If the State determines Vendor is in violation of this provision, the State may immediately terminate this PO and exercise any remedy available at law or in equity.

Section 5: State Audit Rights and Vendor Records.

• 5.1 Vendor Records. Vendor shall maintain a file of all documents, records, communications, notes, and other materials relating to the work (the “Vendor Records”). Vendor Records shall include all documents, records, communications, notes and other materials maintained by Vendor that relate to any work performed by Subcontractors, and Vendor shall maintain all records related to the work performed by Subcontractors required to ensure proper performance of that work. Unless a longer period is required in this PO or any attachment or exhibit to this PO, Vendor shall maintain Vendor Records until the last to occur of:

o the date 3 years after the date this Purchase Order expires or is terminated, o final payment under this Purchase Order is made, o the resolution of any pending Purchase Order matters, or o if an audit is occurring, or Vendor has received notice that an audit is pending, the date such audit is completed and its findings have been resolved (the “Record Retention Period”).

Vendor shall permit the State, the federal government, and any other duly authorized agent of a governmental agency to audit, inspect, examine, excerpt, copy, and transcribe Vendor Records during the Record Retention Period. Vendor shall make Vendor Records available during normal business hours at Vendor’s office or place of business, or at other mutually agreed upon times or locations, upon no fewer than 2 Business Days’ notice from the State, unless the State determines that a shorter period of notice, or no notice, is necessary to protect the interests of the State. The State, in its discretion, may monitor Vendor’s performance of its obligations under this Purchase Order using procedures as determined by the State. The State shall monitor Vendor’s performance in a manner that does not unduly interfere with Vendor’s performance of the work. Vendor shall promptly submit to the State a copy of any final audit report of an audit performed on Vendor’s records that relates to or

Page 16 of 20 Rev. 09/2026 affects this Purchase Order or the work, whether the audit is conducted by Vendor or a third party.

Page 17 of 20 Rev. 09/2026

ADDENDUM 2: Additional Terms & Conditions for Federal Provisions

IF ANY PART OF THIS PO HAS BEEN FUNDED, IN WHOLE OR IN PART, WITH FEDERAL FUNDS, THE

FOLLOWING PROVISIONS SHALL ALSO APPLY TO THIS PO.

Section 1: Applicability of Provisions.

The Contract or Purchase Order to which these Federal Provisions are attached has been funded, in whole or in part, with an Award of Federal funds. In the event of a conflict between the provisions of these Federal Provisions, the Special Provisions, the body of the Contract or Purchase Order, or any attachments or exhibits incorporated into and made a part of the Contract or Purchase Order, the provisions of these Federal Provisions shall control.

Section 2: Compliance.

Contractor shall comply with all applicable provisions of the Transparency Act, all applicable provisions of the Uniform Guidance, and the regulations issued pursuant thereto, including but not limited to these federal Provisions. Any revisions to such provisions or regulations shall automatically become a part of these Federal Provisions, without the necessity of either party executing any further instrument. The State of Colorado may provide written notification to Contractor of such revisions, but such notice shall not be a condition precedent to the effectiveness of such revisions.

Section 3: System for Award Management (SAM) and UNIQUE ENTITY ID Requirements.

SAM. Contractor shall maintain the currency of its information in SAM until the Contractor submits the final financial report required under the Award or receives final payment, whichever is later. Contractor shall review and update SAM information at least annually after the initial registration, and more frequently if required by changes in its information.

Unique Entity ID. Contractor shall provide its Unique Entity ID to its Recipient, and shall update Contractor’s information at http://www.sam.gov at least annually after the initial registration, and more frequently if required by changes in Contractor’s information.

Section 4: Contract Provisions Required by Uniform Guidance Appendix II to Part 200.

A. Contracts for more than the simplified acquisition threshold, which is the inflation adjusted amount determined by the Civilian Agency Acquisition Council and the Defense Acquisition Regulations Council (Councils) as authorized by 41 U.S.C. 1908, must address administrative, contractual, or legal remedies in instances where contractors violate or breach contract terms, and provide for such sanctions and penalties as appropriate. The simplified acquisitions threshold is $250,000 B. All contracts in excess of $10,000 must address termination for cause and for convenience by the non-Federal entity including the manner by which it will be effected and the basis for settlement.

C. Equal Employment Opportunity. Except as otherwise provided under 41 CFR Part 60, all contracts that meet the definition of “federally assisted construction contract” in 41 CFR Part 60-1.3 must include the equal opportunity clause provided under 41 CFR 60-1.4(b), in accordance with Executive Order 11246, “Equal Employment Opportunity” (30 FR 12319, http://www.sam.gov/

Page 18 of 20 Rev. 09/2026

12935, 3 CFR Part, 1964-1965 Comp., p. 339), as amended by Executive Order 11375, “Amending Executive Order 11246 relating to Equal Employment Opportunity,” and implementing regulations at 41 CFR Part 60, “Office of federal Contract Compliance Programs, Equal Employment Opportunity, Department of Labor.”

D. Davis-Bacon Act, as amended (40 U.S.C. 3141-3148). When required by Federal program legislation, all prime construction contracts in excess of $2,000 awarded by non-Federal entities must include a provision for compliance with the Davis-Bacon Act (40 U.S.C. 3141- 3144, and 3146-3148) as supplemented by Department of Labor regulations (29 CFR Part 5, “Labor Standards Provisions Applicable to Contracts Covering Federally Financed and Assisted Construction”). In accordance with the statute, contractors must be required to pay wages to laborers and mechanics at a rate not less than the prevailing wages specified in a wage determination made by the Secretary of Labor. In addition, contractors must be required to pay wages not less than once a week. The non-Federal entity must place a copy of the current prevailing wage determination issued by the Department of Labor in each solicitation. The decision to award a contract or subcontract must be conditioned upon the acceptance of the wage determination. The non-Federal entity must report all suspected or reported violations to the Federal awarding agency.