MCSA0103_StreamSets_fully_signed.pdf

StreamSets, Inc. Master Cloud Services Agreement MCSA0103 Page 1 Form Date: 12.15.21

STREAMSETS, INC.

MASTER CLOUD SERVICES AGREEMENT #MCSA0103

This Master Cloud Services Agreement #MCSA0103 (“Contract”) is by and between StreamSets, Inc. (“Contractor”), having an office at 1875 South Grant Street, Suite 810, San Mateo, California 94402, and the State of Ohio (“State”), through its Department of Administrative Services (“DAS”), having its principal place of business at 30 East Broad Street, 40th Floor, Columbus, Ohio 43215.

The State and the Contractor are sometimes referred to jointly as the "Parties" or individually as a “Party.” The effective date of this Contract is the date it is signed by the State.

1. General Information

1.1. Organization

This Contract covers subscriptions to cloud services through one or more attachments (“Service Attachments”) that describe the cloud offerings (“Services” or “Service”) that the Contractor makes available to its customers by subscription and that it is authorized to sell to the State. The Service Attachments describe the Services the Contractor offers under this Contract along with any special terms or conditions applicable only to those Services, descriptions of those Services, features, all fees associated with such Services, and any other provisions to which the Parties have agreed with respect to those Services. Such Service Attachments, when executed by the Parties, are incorporated into this Contract and become a part hereof.

1.2. Subscribers

A “Subscriber” means any of the following: (i) State entities such as agencies, boards, and commissions that place requests (“Orders”) through the State’s ordering system described in another section under this Contract for any of the Services identified by one or more Service Attachments incorporated into this Contract; (ii) Other entities of the State, such as the legislative and judicial branches of State government and the independent offices of elected State officials that place Orders under this Contract; and

(iii) Cooperative Purchasing Members, defined in the next section, that place Orders under this Contract.

1.3. Cooperative Purchasing Members

“Cooperative Purchasing Members” are entities that qualify for participation in the State’s cooperative purchasing program under Section 125.04 of the Ohio Revised Code (“R.C.”) and that have completed the steps necessary to participate in that program. They may include Ohio political subdivisions, such as counties, townships, municipal corporations, school districts, conservancy districts, township park districts, park districts created under R.C. Chapter 1545, regional transit authorities, regional airport authorities, regional water and sewer districts, and port authorities. They also may include any Ohio county board of elections, state institutions of higher education, private fire companies, private, nonprofit emergency medical service organizations, and chartered nonpublic schools.

1.4. Term

This Contract is effective on the date of final signature below. Unless earlier terminated as set forth herein, this Contract will expire on March 31, 2026.

DocuSign Envelope ID: 0288A489-7729-4EBA-BE5E-E9E6918DC102

StreamSets, Inc. Master Cloud Services Agreement MCSA0103 Page 2

1.5. Contract – Renewal

The State may renew this Contract by issuing written notice to the Contractor of the decision to do so. Renewals will be initiated by the State in writing before the expiration of the then-current term. This expiration and renewal procedure will also apply to the end of any subsequent renewal term. For the avoidance of doubt, the Contract will not be renewed if StreamSets does not agree to the renewal.

1.6. Service Attachment(s) – Renewal

As part of the renewal of this Contract, the State may renew any or all Service Attachments under this Contract. Unless otherwise specified in the written renewal notice or in a Service Attachment, all Service Attachments are renewed upon the renewal of this Contract. Individual Orders under a Service Attachment may be renewed as long as the applicable Service Attachment remains in effect. Any such Order renewal is effective only on issuance of a purchase order from the Subscriber for the applicable Service.

After the first renewal, the Parties agree that pricing of Services under any Service Attachment may be renegotiated.

The Subscribers have the option anytime during the Contract’s term to upgrade to a new technology or Service offering with the Contractor without incurring any fees for terminating the existing technology or Service early (“Early Termination Charge”), if any such charge is provided for in the applicable Service Attachment. Any such upgrade to a new technology or Service offering will be as mutually agreed between the Subscriber and Contractor regarding the applicable fees and credits for that upgrade.

1.7. Relationship of the Parties and Subscribers

It is fully understood and agreed that Contractor is an independent contractor and is not an agent, servant, or employee of the State or any Subscriber. Contractor declares that it is engaged as an independent business and has complied with all applicable federal, state, and local laws regarding business permits and licenses of any kind, including but not limited to any insurance coverage, workers’ compensation, or unemployment compensation that is required in the normal course of business and will assume all responsibility for any federal, state, municipal, or other tax liabilities. Additionally, Contractor understands that as an independent contractor, it is not a public employee and is not entitled to contributions from the State to any public employee retirement system.

Contractor acknowledges and agrees any individual providing personal services under this Contract is not a public employee for purposes of Chapter 145 of the Ohio Revised Code. Unless Contractor is a “business entity” as that term is defined in Section 145.037 of the Ohio Revised Code (“an entity with five or more employees that is a corporation, association, firm, limited liability company, partnership, sole proprietorship, or other entity engaged in business”), Contractor will have any individual performing services under the Contract complete and submit to the Subscriber the Independent Contractor/Worker Acknowledgement form, available at https://www.opers.org/forms-archive/PEDACKN- Independent-Contractor-Worker-Acknowledgment.pdf.

https://www.opers.org/forms-archive/PEDACKN-Independent-Contractor-Worker-Acknowledgment.pdf https://www.opers.org/forms-archive/PEDACKN-Independent-Contractor-Worker-Acknowledgment.pdf

StreamSets, Inc. Master Cloud Services Agreement MCSA0103 Page 3

Contractor’s failure to complete and submit the Independent Contractor/Worker Acknowledgement form prior to providing any Service or commencement of any work, service or deliverable, provided under this Contract, will serve as Contractor’s certification that Contractor is a “business entity” as the term is defined in R.C. 145.037.

1.8. Dealers and Distributors

The State authorizes the Contractor to name one or more dealers to work with the State on behalf of the Contractor. If the Contractor decides to use any dealers, the Contractor must submit to the State the name, principal business address, addresses for Orders and for payments, telephone number, and federal tax identification number of each dealer it wishes to name under this section. The Contractor also must submit a completed W9 form for each dealer. The Contractor's submission must be on its official letterhead, signed by an authorized representative, and sent to the address listed in the Notices section of this Contract. Each named dealer must be properly registered in the Office of Budget and Management Shared Services via the Ohio Supplier Portal (supplier.ohio.gov) in order to receive payment under this Contract.

In doing the above, the Contractor warrants that:

i. The Contractor has provided the dealer with a copy of this Contract and a duly authorized representative of the dealer has agreed, in writing, to be bound by the terms and conditions in this Contract.

ii. The agreement with the dealer specifically provides that it is for the benefit of the State as well as the Contractor.

iii. The Contractor will remain liable under this Contract for the Services of its dealers and will remedy any breach of any of its dealers under this Contract.

iv. Payments under this Contract for the Services of any dealer may be made directly to that dealer, and the Contractor will look solely to the dealer for any payments due to the Contractor once the State has paid the dealer.

v. To the extent that there is any liability to the State arising from doing business with a dealer that has not signed the agreement required under this section with the Contractor, the Contractor will indemnify the State for such liability.

If the Contractor wants to designate a dealer that will not receive payments (a "distributor"), the Contractor may do so by identifying the person or organization as a distributor in the authorizing letter. In such cases, the taxpayer identification and payment address may be omitted from the authorizing letter, and a W9 form is not required. All other requirements and obligations for designating a dealer apply to designating a distributor.

Revised Code 125.081 requires the State to set-aside purchases for Minority Business Enterprises (“MBE”) and Executive Order 2008-13S encourages use of Encouraging Diversity, Growth and Equity (“EDGE”) businesses. Therefore, the State encourages the Contractor to purchase goods and services from Ohio certified MBE and EDGE vendors and to use such for its dealers and distributors under this Contract.

1.9. State Audits and Reporting Requirements

1.9.1 State Audits. Contractor must keep all financial records in a manner consistent with Generally Accepted Accounting Principles (GAAP) or equivalent accounting principles.

Additionally, Contractor must keep separate business records for this Contract, including

StreamSets, Inc. Master Cloud Services Agreement MCSA0103 Page 4 records of disbursements and obligations incurred that must be supported by quotes, invoices, vouchers and other data as appropriate.

During the term of this Contract and for three years after its termination or expiration, on reasonable notice and during customary business hours, the State may audit the Contractor's records and other materials that relate to (i) the Services performed under this Contract, or (ii) any billing or invoices under the Contract, and Contractor agrees to provide the State with access to and the right to examine any records or other materials pertaining to (i) and (ii) above. This audit right also will apply to the State's duly authorized representatives and any organization providing funding for any Order hereunder. Upon written request from the State detailing the basis for the requested audit, the Contractor must make such records and materials available to the State as soon as possible, but no later than fifteen (15) business days after receiving the State’s written notice of its intent to audit the Contractor’s records and must notify the State as soon as the records are ready for audit. Notwithstanding the foregoing, before requesting any of the herein referenced materials from Contractor, the State shall first use best efforts to obtain the required information from the relevant Subscriber(s) and will only request from Contractor any reasonably missing or additional information as necessary and within the scope of the applicable audit. If the audit results in a determination that Contractor has overcharged a Subscriber, then Contractor will credit or refund the overcharged amounts within thirty (30) days of conclusion of the audit, including reimbursement to the State of the cost of the audit.

1.9.2. Quarterly Reporting. Contractor must report the quarterly dollar value (in U.S.

currency rounded to the nearest whole dollar) of the sales under this Contract each calendar quarter (i.e., January-March, April-June, July-September and October- December). The dollar value of the sales reported must equal the price paid by all State agencies and Cooperative Purchasing Members for purchases under this Contract during the reporting period.

Contractor must submit the quarterly sales report to the State via the State’s ordering system, and when Contractor will be submitting a payment, Contractor must also complete and submit the Quarterly Sales Report and Revenue Share Remittance Form (available at https://das.ohio.gov/revenueshareform) with Contractor’s Revenue Share payment. If no sales occur, Contractor must show zero sales on the report. The report must be submitted 30 days after the completion of the reporting period.

Contractor also must submit a closeout sales report within 120 days after the expiration of this Contract. For purposes of this subsection 1.9.2, the Contract expires on the physical completion of the last, outstanding task or completion of an Order of the Contract. The closeout sales report must cover all sales not shown in the final quarterly sales report and reconcile all errors and credits. If Contractor reported all Contract sales and reconciled all errors and credits on the final quarterly sales report, then Contractor should show zero sales in the closeout sales report.

If Contractor fails to submit any sales report in a timely manner or falsifies any sales report, the State may terminate this Contract for cause.

1.9.3. Other Reports. The State also may require various additional reports from the Contractor related to the Services. Such reports include those identified in any Service Attachment. Further, the State will be entitled to any other reports that the Contractor https://das.ohio.gov/revenueshareform

StreamSets, Inc. Master Cloud Services Agreement MCSA0103 Page 5 makes generally available to its other customers without additional charge. The State’s rights under this section will apply to all Services provided to all Subscribers under this Contract, but a Subscriber’s rights to reports will apply solely to Services it orders or receives under this Contract.

1.10. Subscribers’ Reliance on Contract

Subscribers may rely on this Contract. Whenever a Subscriber is a Cooperative Purchasing Member and relies on this Contract to issue an Order, the Subscriber will step into the shoes of the State under this Contract for purposes of its Order, and, as to the Subscriber's Order, this Contract will be between the Contractor and that Subscriber. The Contractor must look exclusively to that Subscriber for performance, including, but not limited to payment, and must hold the State harmless regarding such Orders and the Subscriber's performance.

1.11. Third-Party Suppliers

The Contractor must incorporate the costs of any third-party supplies and services in the Contractor’s fees identified on the applicable Service Attachment under this Contract.

The Contractor’s use of other suppliers does not mean that the State will pay for them unless State or a Subscriber agreed to do so in the applicable Order and such pricing is included in a Service Attachment under this Contract. Except as set forth in the previous sentence, the Contractor will be solely responsible for payment of its suppliers and any claims of those suppliers for any failure of the Contractor to meet its obligations under this Contract or other agreement with the suppliers. The Contractor will hold the State harmless and indemnify the State against any such claims unless the State or a Subscriber, through breach of its obligations herein, is the cause for Contractor’s failure to pay third-party suppliers.

The Contractor assumes responsibility for all Services provided under this Contract whether it or one of its suppliers provides them in whole or in part. Further, the Contractor will be the sole point of contact for all contractual matters, including payment of all charges resulting from the Contract and all Service requests.

1.12. Non-Exclusivity

This Contract is non-exclusive and is not a requirements contract. Nothing herein prevents either Party from entering into similar agreements with other entities.

1.13. Competitive Pricing and Services

For the purposes of maintaining pricing and Service competitiveness through the term of the Contract, the Contractor agrees to periodically review and discuss its pricing and Service offerings with the State upon request. Requests for amendments to the Service Attachments to reduce fees and introduce technological Service improvements may be submitted by Contractor at any time throughout the term of the Contract.

StreamSets, Inc. Master Cloud Services Agreement MCSA0103 Page 6

1.14. Conflict Resolution

If one Party believes the other Party has violated or is not complying with the terms of this Contract or if any other dispute arises under this Contract, the Party raising the matter may provide to the other Party written notice referencing this section and specifying the nature of the dispute (the “Dispute Notification”). The Parties then will seek to resolve the dispute in accordance with the procedures in this section.

i. All disputes will be submitted first to the authorized State or Subscriber representative (or designee) and the Contractor’s representative for resolution. For 15 days from receipt of the Dispute Notification, the authorized State or Subscriber representative and Contractor’s representative will discuss and attempt to resolve the dispute in good faith.

ii. If after the 15 days identified above, the authorized State or Subscriber representative and the Contractor’s representative are unable to resolve the dispute, the Parties will then escalate the dispute to the proper State or Subscriber and Contractor representatives for resolution. For the next 15 days, the escalated State or Subscriber and Contractor representatives will discuss and attempt to resolve the dispute in good faith.

iii. If following the 15 days in the previous paragraph, the State’s or Subscriber’s and the Contractor’s escalated representatives are still unable to resolve the dispute, the Parties will then further escalate the dispute to the State’s Chief Information Officer (“CIO”) or a designee, or the equivalent Subscriber representative, and to the Contractor’s Vice President level for resolution. For the next 15 days, the State’s CIO or Subscriber representative and Contractor’s Vice President will discuss and attempt to resolve the dispute in good faith. If the State’s CIO or Subscriber representative and Contractor’s Vice President are unable to resolve the dispute within that time, the Parties will nevertheless continue to retain their rights to initiate formal proceedings hereunder.

The specific format for such discussions will be left to the discretion of the representatives of the State or Subscriber and Contractor responsible for attempting to resolve the dispute, but each Party will involve the business, technical, and legal resources reasonably necessary to attempt in good faith to resolve the dispute at the earliest possible time and without undue delay.

If the Parties are unable to resolve the dispute and the dispute involves a claim that the Contractor is noncompliant with its obligations hereunder or has overcharged for a Service, the State or affected Subscribers may withhold payment for any Services that are the subject of the dispute until the Contractor cures the noncompliance, the Parties arrive at an agreement to resolve the dispute, or a Party obtains a resolution in a court of competent jurisdiction.

Nothing in this section is intended to limit the rights provided under the termination section of this Contract or be a prerequisite to exercising those rights.

Once the dispute has been resolved, any payments withheld will be handled in the following manner:

i. If the resolution was in favor of the State or one or more Subscribers, the Contractor will issue a credit on the next invoice for the affected Subscribers. If

StreamSets, Inc. Master Cloud Services Agreement MCSA0103 Page 7 the credit exceeds the Service charges on the next invoice or an invoice will not be issued within 60 days of the resolution, the Contractor will issue payment in the form of a check in the amount exceeding the Service charges or for the full amount if an invoice will not be issued within 60 days. Any such checks must be issued within that 60-day period.

ii. If in favor of the Contractor, the affected Subscribers will submit appropriate payment within 30 days of receiving notification of the resolution at the office designated to receive the invoice and receiving a proper invoice.

iii. In either of the above cases, the amount or amounts withheld by the State or Subscriber(s) will be taken into account in calculating any amount(s) due.

2. General Requirements for Cloud Services

2.1. Standards

All Service subscriptions will provide a Service that maintains a redundant infrastructure that will ensure access for all the State’s enrolled users in case of a failure at any one of the Contractor locations, with effective contingency planning (including back-up and disaster recovery capabilities) and 24x7 trouble shooting service for inquiries, outages, issue resolutions, etc. They must meet the Service Level Agreements (“SLAs”) provided in the applicable Service Attachment and issue any credits or refunds for any failure to meet the SLAs, as provided in the applicable Service Attachment. The Services must also be supported with sufficient connectivity and computing resources to handle reasonably anticipated peak demand and the Contractor must ensure that sufficient bandwidth and computing resources are dedicated to the Services to meet peak demand times without material degradation in performance.

All Services must operate at the moderate level baseline as defined in National Institute of Standards and Technology (“NIST”) Special Publication 800-53, “Security and Privacy Controls for Federal Information Systems and Organizations” (current, published version), be consistent with Federal Information Security Management Act (FISMA) requirements, and offer a customizable and extendable capability based on open-standards APIs that enable integration with third party applications. Regarding third party integration, a Subscriber must have its own accounts for third-party endpoints and is solely responsible for complying with any terms of service, privacy policies or other agreements governing third-party endpoints and integrations, generally. Contractor is not responsible or liable for any endpoints or the availability of integrations with any third-party endpoints if those endpoints change (which may change from time to time). If an integration becomes unavailable due to a third-party endpoint change, Contractor must work with the applicable Subscriber(s) to restore the integration. The Services must provide the State’s systems administrators with 24x7 visibility into the Services through a real-time, web-based “dashboard” capability that enables them to monitor, in real or near real time, the Services’ performance against the established SLAs and promised operational parameters.

The Contractor has and will continue to use industry standard efforts through quality assurance procedures to test for and ensure that there are no viruses, malware, or undocumented features in its infrastructure and Services and that they do not contain any embedded device or code (e.g., time bomb) that is intended to obstruct or prevent any use of or access to them by the Subscribers. The Contractor hereby waives under any and all circumstances any right it may have or may hereafter have to exercise electronic self-help.

StreamSets, Inc. Master Cloud Services Agreement MCSA0103 Page 8

User access to the Services must be capable of using SAML or OpenID Connect protocols to securely federate with the State’s identity provider service in order to: (i) support single sign-on capability for users; (ii) ensure that every user is tied to an identity provider account; and (iii) prevent user access when a user is disabled or deleted in the applicable identity provider user store. Active Directory or other LDAP services should be used only as an alternative if SAML or OpenID Connect are unavailable.

2.2. Contractor Audit Requirements

The Contractor must obtain an annual audit of the Services that meets the American Institute of Certified Public Accountants (AICPA) Statements on Standards for Attestation Engagements (SSAE) No. 18, Service Organization Control 1 Type 2 and Service Organization Control 2 Type 2. The audit must cover all operations pertaining to the Services covered by this Contract. The audit will be at the sole expense of the Contractor and the results must be provided to the State within 30 days of Contractor’s receipt of its audit results each year.

At no cost to the State, the Contractor must immediately remedy any issues, material weaknesses, or other items identified in each audit as they pertain to the Services.

2.3. State Supplements A and S

Contractor must comply with Supplement S, State Information Security and Privacy Requirements, State Data Handling Requirements, the form of which is attached to this Contract as Exhibit I. Supplement S, as modified by Contractor’s responses therein and as mutually agreed upon by the Parties, is incorporated into this Contract as if fully rewritten herein.

Contractor must comply with Supplement A, State IT Policy, Standard and Service Requirements, the form of which is attached to this Contract as Exhibit II. Supplement A, as modified by Contractor’s responses therein and as mutually agreed upon by the Parties, is incorporated into this Contract as if fully rewritten herein.

Contractor may be required to complete a new Supplement A and/or S for additional products, Services or Service Attachments under this Contract, and each new Supplement A and/or S, as modified by Contractor’s responses therein and as mutually agreed upon by the Parties, is incorporated into this Contract as if fully rewritten herein.

2.4. Object Reassignment

Any Service subscriptions that are provided by the number of items that may be used by or in conjunction with it, such as cores, nodes, users, or connections (“Objects”), may be reassigned to other, similar Objects within the Subscriber’s organization at any time and without any additional fee or charge. For example, a named user subscription may be assigned to another user. Any such reassignment must be in conjunction with cessation of use by or with the previous Object, if such cessation is required to keep the total number of licensed Objects within the scope of the applicable subscription. Should a Subscriber require a special code, unique key, or similar item to reassign the subscription as contemplated by this section, the Contractor will provide such a code, key, or similar item to the Subscriber at any time and without a fee or charge, subject to the conditions of this

StreamSets, Inc. Master Cloud Services Agreement MCSA0103 Page 9 section 2.4. For clarity, a later section in this Contract governs assignment of a Service subscription to a successor in interest.

2.5. Reserved

2.6. Contractor Warranties

The Contractor warrants the following:

i. It has validly entered into this Contract and has the legal power to do so.

ii. The Services will perform materially in accordance with the applicable user guide, technical materials, related writings, and the requirements of this Contract.

iii. Subject to any limitations specified in the applicable Service Attachment, the functionality of the Services will not be materially decreased during a subscription term.

iv. It will use commercially reasonable efforts to not transmit viruses, worms, time bombs, Trojan horses or other harmful or malicious code, files, scripts, agents or programs (“Malicious Code”) to a Subscriber.

For any breach of a warranty above, the State’s and individual Subscribers’ remedies will be as provided in the section of this Contract dealing with termination.

Contractor also warrants that:

i. The recommendations, guidance, and performance of the Contractor under this Contract will be in accordance with the industry’s professional standards, the requirements of this Contract, the documentation provided by Contractor under this Contract and applicable Service Attachment(s), and without any material defect.

ii. No Service will infringe on the intellectual property rights of any third party.

iii. All warranties are in accordance with the Contractor’s standard business practices.

iv. The Services comply with applicable governmental, environmental and safety standards.

v. Contractor has the right to enter into this Contract.

vi. The Contractor has not entered into any other contracts or employment relationships that restrict the Contractor’s ability to perform under this Contract.

vii. The Contractor will observe and abide by all applicable laws and regulations, including those of the State regarding conduct on any premises under the State’s control.

viii. The Contractor has good and marketable title to any Service or related equipment delivered under this Contract for which title passes to the State, if any.

ix. The Contractor has the right and ability to grant the license granted in any Service for which title does not pass to the State.

x. The Contractor has not and will not enter into any other contracts without written approval of the State to perform or provide substantially identical Services to the State such that it is duplicative of this Contract.

The Contractor must notify the State in writing immediately upon the discovery of any breach of the warranties given above, or if any work of the Contractor or any Service fails to comply with these warranties, and the Contractor is so notified in writing, the Contractor will correct such failure in a commercially reasonable time or as specified in the Contract.

StreamSets, Inc. Master Cloud Services Agreement MCSA0103 Page 10

If the Contractor fails to comply, the Contractor will refund the amount paid for the impacted Service(s) but shall not be obligated to refund of any fees already earned for Service(s) delivered by Contractor. The Contractor will also indemnify the State for any direct damages and claims by third parties based on breach of these warranties, subject to the limitations contained in section 3.2.

Failure of the Contractor to meet any SLAs in an applicable Service Attachment will not be considered a breach of this warranty section unless the State reasonably determines that the failure is Persistent or Extended in duration. For purposes of this Contract, “Persistent or Extended” means the failure of the Services to meet the required availability set forth in the applicable Service Attachment(s) in any three consecutive month period or in four non-consecutive months in a 12-month period.

2.7. State and Subscribers Responsibilities

The State and each Subscriber will be responsible for their respective compliance with this Contract. Additionally, each Subscriber will:

i. Be responsible for the accuracy, quality, and legality of its data and of the means by which the data was acquired;

ii. Use commercially reasonable efforts to prevent unauthorized access to or use of the Services to which it subscribes and notify the Contractor promptly of any unauthorized access or use of which it becomes aware; and

iii. Use the Services only in accordance with the applicable user guide, to the extent it is not inconsistent with this Contract, applicable laws, or government regulations.

A Subscriber may not:

i. Intentionally permit any third party to access or make the Services available to anyone other than its employees and contractors acting on its behalf unless the applicable Service(s) is designed to be publicly-facing or intended for interaction with clients of the Subscriber (e.g., hosted websites), or as otherwise specifically permitted herein;

ii. Sell, resell, rent or lease the Services;

iii. Create derivative works based on the Services except as permitted herein.

iv. Reverse engineer the Services;

v. Use or access the Services to build a competitive product or service or to copy any features, functions, or graphics of the Services;

vi. Use the Services to store or transmit infringing, libelous, or otherwise unlawful or tortious material, or to store or transmit material in violation of third-party privacy rights;

vii. Intentionally use the Services to store or transmit Malicious Code;

viii. Intentionally interfere with or disrupt the integrity or performance of the Services or third-party data contained therein; or

ix. Attempt to gain unauthorized access to the Services or their related systems or networks.

StreamSets, Inc. Master Cloud Services Agreement MCSA0103 Page 11

3. Insurance, Indemnification, Limitation of Liability

3.1. Insurance

Contractor must procure and maintain for the duration of the Contract insurance against claims for injuries to persons or damages to property which may arise from or in connection with the performance of the work hereunder by the Contractor, its agents, representatives, or employees. Contractor must procure and maintain for the duration of the Contract insurance for claims arising out of their services and including, but not limited to loss, damage, theft or other misuse of data, infringement of intellectual property, invasion of privacy and breach of data.

Coverage must be at least as broad as:

i. Commercial General Liability: written on an "occurrence" basis, including products and completed operations, property damage, bodily injury and personal and advertising injury with limits no less than $1,000,000 per occurrence. If a general aggregate limit applies, either the general aggregate limit will apply separately to this project/location or the general aggregate limit will be twice the required occurrence limit. Defense costs will be outside the policy limit.

ii. Automobile Liability: covering Code 1 (any auto), or if Contractor has no owned autos, Code 8 (hired) and 9 (non-owned), with a limit no less than $1,000,000 per accident for bodily injury and property damage.

iii. Workers' Compensation insurance as required by the State of Ohio, or the state in which the work will be performed, with Statutory Limits, and Employer's Liability Insurance with a limit of no less than $1,000,000 per accident for bodily injury or disease. If Contractor is a sole proprietor, partnership or has no statutory requirement for workers’ compensation, Contractor must provide a letter stating that it is exempt and agreeing to hold the State and Subscribers harmless from loss or liability for such.

iv. Technology Errors and Omissions and Cyber Liability Insurance with limits not less than $5,000,000 per occurrence or claim, $5,000,000 aggregate. Coverage shall be sufficiently broad to respond to the duties and obligations as are undertaken by Contractor in this Contract and shall cover all applicable Contractor personnel or subcontractors who perform professional services related to this Contract.

Coverage shall include, but not be limited to, infringement of copyright, trademark, trade dress, invasion of privacy violations, information theft, damage to or destruction of electronic information, release of private information, alteration of electronic information, extortion and network security. The coverage shall provide for breach response costs as well as regulatory fines and penalties and credit monitoring expenses with sub-limits sufficient to respond to these obligations. This coverage requirement may be satisfied with any combination of policies, whether packaged or standalone, and include any applicable excess or umbrella coverage.

The insurance obligations under this Contract are the minimum insurance coverage requirements and/or limits shown in this Contract. Any insurance proceeds in excess of or broader than the minimum required coverage and/or minimum required limits, which are applicable to a given loss, will be available to the State of Ohio. No representation is made that the minimum insurance requirements of this Contract are sufficient to cover the obligations of the Contractor under this Contract.

StreamSets, Inc. Master Cloud Services Agreement MCSA0103 Page 12

The insurance policies are to contain, or be endorsed to contain, the following provisions:

i. Additional Insured Status Except for Workers’ Compensation and Professional Liability and Cyber Liability insurance, the State of Ohio, its officers, officials and employees are to be covered as additional insureds with respect to liability arising out of work or operations performed by or on behalf of the Contractor including materials, parts, or equipment furnished in connection with such work or operations. Coverage can be provided in the form of an endorsement to the Contractor’s insurance.

ii. Primary Coverage

For any claims related to this Contract, the Contractor’s insurance coverage must be primary insurance. Any insurance or self-insurance maintained by the State of Ohio, its officers, officials and employees will be excess of the Contractor’s insurance and will not contribute with it.

iii. Umbrella or Excess Insurance Policies

Umbrella or excess commercial liability policies may be used in combination with primary policies to satisfy the limit requirements above. Such Umbrella or excess commercial liability policies will apply without any gaps in the limits of coverage and be at least as broad as and follow the form of the underlying primary coverage required above.

iv. Notice of Cancellation

Contractor will provide State of Ohio with 30 days written notice of cancellation or material change to any insurance policy required above, except for non-payment cancellation. Material change is defined as any change to the insurance limits, terms or conditions that would limit or alter the State’s available recovery under any of the policies required above. A lapse in any required insurance coverage during this Contract will be a breach of this Contract.

v. Waiver of Subrogation

Contractor hereby grants to State of Ohio a waiver of any right to subrogation which any insurer of said Contractor may acquire against the State of Ohio by virtue of the payment of any loss under such insurance. Contractor agrees to obtain any endorsement that may be necessary to affect this waiver of subrogation, but this provision applies regardless of whether or not the State of Ohio has received a waiver of subrogation endorsement from the insurer.

vi. Self-Insured Retentions

Self-insured retentions must be declared to and approved by the State. The State may require the Contractor to provide proof of ability to pay losses and related investigations, claims administration and defense expenses within the retention. The policy language must provide, or be endorsed to provide, that the self-insured retention may be satisfied by either the named insured or the State.

vii. Claims Made Policies

If any of the required policies provide coverage on a claims-made basis:

a. The Retroactive Date must be shown and must be before the date of the Contract or the beginning of contract work.

StreamSets, Inc. Master Cloud Services Agreement MCSA0103 Page 13

b. Insurance must be maintained and evidence of insurance must be provided for at least five (5) years after completion of the contract work.

c. If coverage is canceled or non-renewed, and not replaced with another claims-made policy form with a Retroactive Date prior to the Contract effective date, the Contractor must purchase "extended reporting'' coverage for a minimum of five

(5) years after completion of contract work. The Discovery Period must be active during the Extended Reporting Period.

Verification of Coverage. Contractor will furnish the State of Ohio with original certificates and amendatory endorsements or copies of the applicable policy language effecting coverage required by this clause. All certificates and endorsements are to be received and approved by the State of Ohio before work commences. However, failure to obtain the required documents prior to the work beginning will not waive the Contractor’s obligation to provide them.

Subcontractors. Contractor shall require and verify that all subcontractors maintain insurance with sufficient limits for the nature of the products or services they are providing, and Contractor shall ensure that State of Ohio is an additional insured on insurance required from subcontractors. Contractor will indemnify the State for damages that exceed a subcontractor’s policy limits.

Special Risks or Circumstances. With reasonable notice to Contractor and mutually agreed upon by both parties, State of Ohio reserves the right to modify these requirements, including limits, based on the nature of the risk, prior experience, insurer, coverage, or other special circumstances.

3.2. Indemnification

The Contractor must indemnify the State and Subscribers for all liability and expense resulting from bodily injury to any person (including injury resulting in death) or damage to State or Subscriber property arising out of the performance of this Contract, provided that such bodily injury or property damage is due to the negligence or other tortious conduct of the Contractor, its employees, agents, or subcontractors. The Contractor will not be responsible for any damages or liability for bodily injury or property damage to the extent caused by the negligence or willful misconduct of the State, a Subscriber, its employees, other contractors, or agents. The parties hereby agree that Subscriber Data is not considered “property” under Ohio Revised Code 9.27 for purposes of this Contract.

Contractor must indemnify the State and Subscribers for all liability and costs not due to the fault or negligence of the State or a Subscriber, up to the Subscriber Data Cap defined in section 3.5, incurred by the State or Subscriber(s) resulting from the unauthorized disclosure or loss of Subscriber Data arising out of Contractor’s performance under this Contract. For the avoidance of doubt, Contractor will not be liable for any damages or costs which result from the State’s or a Subscriber’s breach of any of its obligations hereunder. Damages resulting from the unauthorized disclosure or loss of Subscriber Data will be considered direct damages under this Contract and consists of: (1) damages that arise due to Contractor’s failure to comply with its obligations in this Contract, (2) damages that are awarded against the State or a Subscriber by a court of final adjudication or agreed to in settlement between the parties, or (3) include the following categories, provided that the costs are reasonably incurred and documented: (i) expenses for legally-required notification of impacted individuals resulting from a claim relating to Subscriber

StreamSets, Inc. Master Cloud Services Agreement MCSA0103 Page 14

Data to (a) applicable government agencies or regulatory authorities, and (b) individuals whose personal data have been disclosed (“Affected Individuals”); (ii) non-appealable fines or fees assessed against the State or a Subscriber by a government agency or regulatory authority as a result of a claim relating to Subscriber Data; (iii) costs of providing 12 months of credit monitoring and identity theft protection for Affected Individuals regardless of any limitation on liability of any kind in this Contract; and (iv) other such expenses incurred by the State and/or Subscribers as a result of the unauthorized disclosure or loss of Subscriber Data. Contractor’s obligations under this paragraph apply whether the expenses or costs incurred by the State are performed by State employees or hired contractors, but for the avoidance of doubt, unless specifically stated otherwise in this Contract or a Service Attachment, shall not exceed the limits set forth in section 3.5 of this Contract, to the extent such limitation does not impose an unlawful indemnification obligation on the State or a Subscriber.

3.3. Indemnification for Infringement

Upon written approval of the Ohio Attorney General described below, including acceptance of the indemnification procedures set forth below, Contractor will indemnify release, protect, and hold the State and the Subscribers harmless from any claim of infringement of a copyright, U.S. patent, trade secret, or similar intellectual property right based on the State’s proper use of any Service provided under this Contract. Contractor’s obligations in this Section 3.3 are subject to receiving all reasonably necessary cooperation of the State and Subscribers, at Contractor’s expense for reasonable out-of-pocket costs. If the State’s or Subscriber’s use of the Service is (or in Contractor’s opinion is likely to be) enjoined, if required by settlement or if Contractor determines such actions are reasonably necessary to avoid material liability, Contractor may, in its sole discretion, do any of the following:

i. Modify the offending Service so that it is no longer infringing but provides substantially the same functionality as before the modification;

ii. Replace the offending Service with an equivalent or better non-infringing offering;

iii. Acquire the right for the Subscribers to use the infringing Service as it was intended to be used under this Contract; or

iv. Terminate the infringing Service and refund the amount the Subscribers paid for the Service on a pro rata basis based on the termination date.

The foregoing obligation of indemnification will not apply to the extent the claim of infringement is attributable to: (1) the modification of the Service by any party other than Contactor or based on the State’s or Subscriber’s specifications or requirements; (2) the combination of the Service with products or processes licensed or procured from a party other than Contractor that is not contemplated by Contractor via its documentation; (3) any unauthorized use of the Service; or (4) any action arising as a result of Subscriber Data, or any deliverables or components not provided by Contractor not contemplated by the documentation. THIS SECTION SETS FORTH CONTRACTOR’S SOLE LIABILITY

AND SUBSCRIBERS’ SOLE AND EXCLUSIVE REMEDY WITH RESPECT TO ANY

CLAIM OF INTELLECTUAL PROPERTY INFRINGEMENT AND IS NOT SUBJECT TO

THE LIMITS SET FORTH IN SECTION 3.5 BELOW.

In the event of a potential indemnity obligation under this section and only upon consultation with and written approval of the Ohio Attorney General, the State or Subscriber will: (i) promptly notify the Contractor in writing of the claim, (ii) allow the

StreamSets, Inc. Master Cloud Services Agreement MCSA0103 Page 15

Contractor the right to control the investigation, defense and settlement (if applicable) of such claim at the Contractor’s expense, and (iii) upon request of the Contractor, provide all necessary cooperation at the Contractor’s expense. Failure by the State or Subscriber to notify the Contractor of a claim under this section shall not relieve the Contractor of its obligations under this section, however the Contractor shall not be liable for any litigation expenses that the State or Subscriber incurred prior to the time when notice is given or for any damages and/or costs resulting from any material prejudice caused by the delay or failure to provide notice to the Contractor in accordance with this section. The Contractor may not settle any claim in any matter that would require obligation on the part of the State or a Subscriber, or any admission of fault by the State or a Subscriber, without the State or Subscriber’s prior written consent, such consent not to be unreasonably withheld, conditioned or delayed. Further, any indemnification obligation under this section will not apply if the State or Subscriber settles or makes any admission with respect to a claim without the Contractor’s prior written consent. The State and Subscribers may participate in the defense and settlement at their own expense.

3.4. Limitation of Liability - State

The State and Subscribers’ combined total liability for damages, whether in contract, law, or equity, will not exceed two times the amount of compensation payable to Contractor for the previous 12 months of Service related to the Service Attachment under which the damages occurred or the amount of direct damages incurred by the Contractor, whichever is less. The foregoing does not apply to a breach of payment obligations.

3.5. Limitation of Liability - Contractor

The Parties agree as follows:

i. Neither party will be liable for any indirect, incidental or consequential loss or damage of any kind including but not limited to lost profits, even if the parties have been advised, knew, or should have known of the possibility of damages.

ii. Contractor’s liability under this Contract under any Order for damages other than those excluded by Ohio Revised Code 9.27 shall not exceed two times the amount actually paid or payable by the State or Subscriber to Contractor in the prior 12 months under the applicable Order, to the extent such limitation does not impose an unlawful indemnification obligation on the State or a Subscriber (“General Liability Cap”)

iii. Notwithstanding any other limitation provisions, the Contractor agrees that the Contractor will be liable for all direct loss to the State or Subscribers for bodily injury, death, or damage to property of the State or a Subscriber caused by the negligence, intentional or willful misconduct, fraudulent act, recklessness, or other tortious conduct of the Contractor or Contractor’s employees or agents, or a provision that would otherwise impose an indemnification obligation on the State or a Subscriber.

iv. Any limitation provisions contained in the documents and materials incorporated by reference into this Contract are considered stricken and of no force and effect.

v. With respect to any claims regarding the unauthorized disclosure or loss of Subscriber Data, the total aggregate liability of the…